# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Jan 8 2019 16:19:15 # Log Creation Date: 05.02.2019 13:19:24.894 Process: id = "1" image_name = "pony.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\pony.exe" page_root = "0x2c4a8000" os_pid = "0xe40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00013da5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 4 start_va = 0x60000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 5 start_va = 0xa0000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 6 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 7 start_va = 0x1b0000 end_va = 0x1b1fff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 8 start_va = 0x400000 end_va = 0x41afff entry_point = 0x400000 region_type = mapped_file name = "pony.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\pony.exe") Region: id = 9 start_va = 0x776b0000 end_va = 0x77828fff entry_point = 0x776b0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 10 start_va = 0x7ffb0000 end_va = 0x7ffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 11 start_va = 0x7ffdb000 end_va = 0x7ffddfff entry_point = 0x0 region_type = private name = "private_0x000000007ffdb000" filename = "" Region: id = 12 start_va = 0x7ffde000 end_va = 0x7ffdefff entry_point = 0x0 region_type = private name = "private_0x000000007ffde000" filename = "" Region: id = 13 start_va = 0x7ffdf000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007ffdf000" filename = "" Region: id = 14 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 15 start_va = 0x7fff0000 end_va = 0x7ffc57b4ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 16 start_va = 0x7ffc57b50000 end_va = 0x7ffc57d11fff entry_point = 0x7ffc57b50000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 17 start_va = 0x7ffc57d12000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc57d12000" filename = "" Region: id = 157 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 158 start_va = 0x5bab0000 end_va = 0x5bb22fff entry_point = 0x5bab0000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 159 start_va = 0x5bb30000 end_va = 0x5bb7efff entry_point = 0x5bb30000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 160 start_va = 0x5baa0000 end_va = 0x5baa7fff entry_point = 0x5baa0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 161 start_va = 0x520000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 162 start_va = 0x74f40000 end_va = 0x7502ffff entry_point = 0x74f40000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 163 start_va = 0x75190000 end_va = 0x75305fff entry_point = 0x75190000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 164 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 165 start_va = 0x1c0000 end_va = 0x27dfff entry_point = 0x1c0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 166 start_va = 0x746b0000 end_va = 0x74740fff entry_point = 0x746b0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 167 start_va = 0x7feb0000 end_va = 0x7ffaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 168 start_va = 0x20000 end_va = 0x23fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 169 start_va = 0x280000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 170 start_va = 0x420000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 171 start_va = 0x74750000 end_va = 0x747a8fff entry_point = 0x74750000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 172 start_va = 0x747b0000 end_va = 0x747b9fff entry_point = 0x747b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 173 start_va = 0x747c0000 end_va = 0x747ddfff entry_point = 0x747c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 174 start_va = 0x74a00000 end_va = 0x74aabfff entry_point = 0x74a00000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 175 start_va = 0x74ab0000 end_va = 0x74abbfff entry_point = 0x74ab0000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 176 start_va = 0x74da0000 end_va = 0x74de3fff entry_point = 0x74da0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 177 start_va = 0x75030000 end_va = 0x7517cfff entry_point = 0x75030000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 178 start_va = 0x75180000 end_va = 0x7518efff entry_point = 0x75180000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 179 start_va = 0x75310000 end_va = 0x766cefff entry_point = 0x75310000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 180 start_va = 0x76790000 end_va = 0x76c6cfff entry_point = 0x76790000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 181 start_va = 0x76c70000 end_va = 0x76daffff entry_point = 0x76c70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 182 start_va = 0x76f20000 end_va = 0x76fddfff entry_point = 0x76f20000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 183 start_va = 0x770d0000 end_va = 0x77161fff entry_point = 0x770d0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 184 start_va = 0x77260000 end_va = 0x772a3fff entry_point = 0x77260000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 185 start_va = 0x772b0000 end_va = 0x772f2fff entry_point = 0x772b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 186 start_va = 0x77300000 end_va = 0x7738cfff entry_point = 0x77300000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 187 start_va = 0x77390000 end_va = 0x77549fff entry_point = 0x77390000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 188 start_va = 0x77550000 end_va = 0x775cafff entry_point = 0x77550000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 189 start_va = 0x7ffd8000 end_va = 0x7ffdafff entry_point = 0x0 region_type = private name = "private_0x000000007ffd8000" filename = "" Region: id = 190 start_va = 0x340000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 191 start_va = 0x620000 end_va = 0x7a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 192 start_va = 0x74df0000 end_va = 0x74f0ffff entry_point = 0x74df0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 193 start_va = 0x74f10000 end_va = 0x74f3afff entry_point = 0x74f10000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 194 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 195 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 196 start_va = 0x7b0000 end_va = 0x930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 197 start_va = 0x940000 end_va = 0x1d3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000940000" filename = "" Region: id = 198 start_va = 0x1d40000 end_va = 0x1e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 199 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 200 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 201 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 202 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 203 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 204 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 205 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 206 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 207 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 208 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 209 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 210 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 211 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 212 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 213 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 214 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 215 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 216 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 217 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 218 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 219 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 220 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 221 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 222 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 223 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 224 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 225 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 226 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 227 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 228 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 229 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 230 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 231 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 232 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 233 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 234 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 235 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 236 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 237 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 238 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 239 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 240 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 241 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 242 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 243 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 244 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 245 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 246 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 247 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 248 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 249 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 250 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 251 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 252 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 253 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 254 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 255 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 256 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 257 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 258 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 259 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 260 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 261 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 262 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 263 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 264 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 265 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 266 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 267 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 268 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 269 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 270 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 271 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 272 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 273 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 274 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 275 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 276 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 277 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 278 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 279 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 280 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 281 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 282 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 283 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 284 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 285 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 286 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 287 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 288 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 289 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 290 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 291 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 292 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 293 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 294 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 295 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 296 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 297 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 298 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 299 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 300 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 301 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 302 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 303 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 304 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 305 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 306 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 307 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 308 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 309 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 310 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 311 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 312 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 313 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 314 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 315 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 316 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 317 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 318 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 319 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 320 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 321 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 322 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 323 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 324 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 325 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 326 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 327 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 328 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 329 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 330 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 331 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 332 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 333 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 334 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 335 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 336 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 337 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 338 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 339 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 340 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 341 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 342 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 343 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 344 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 345 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 346 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 347 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 348 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 349 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 350 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 351 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 352 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 353 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 354 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 355 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 356 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 357 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 358 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 359 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 360 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 361 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 362 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 363 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 364 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 365 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 366 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 367 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 368 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 369 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 370 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 371 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 372 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 373 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 374 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 375 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 376 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 377 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 378 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 379 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 380 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 381 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 382 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 383 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 384 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 385 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 386 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 387 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 388 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 389 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 390 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 391 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 392 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 393 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 394 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 395 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 396 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 397 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 398 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 399 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 400 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 401 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 402 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 403 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 404 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 405 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 406 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 407 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 408 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 409 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 410 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 411 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 412 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 413 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 414 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 415 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 416 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 417 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 418 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 419 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 420 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 421 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 422 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 423 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 424 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 425 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 426 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 427 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 428 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 429 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 430 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 431 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 432 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 433 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 434 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 435 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 436 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 437 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 438 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 439 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 440 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 441 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 442 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 443 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 444 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 445 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 446 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 447 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 448 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 449 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 450 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 451 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 452 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 453 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 454 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 455 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 456 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 457 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 458 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 459 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 460 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 461 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 462 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 463 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 464 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 465 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 466 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 467 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 468 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 469 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 470 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 471 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 472 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 473 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 474 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 475 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 476 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 477 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 478 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 479 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 480 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 481 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 482 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 483 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 484 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 485 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 486 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 487 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 488 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 489 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 490 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 491 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 492 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 493 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 494 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 495 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 496 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 497 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 498 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 499 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 500 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 501 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 502 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 503 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 504 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 505 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 506 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 507 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 508 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 509 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 510 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 511 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 512 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 513 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 514 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 515 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 516 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 517 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 518 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 519 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 520 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 521 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 522 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 523 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 524 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 525 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 526 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 527 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 528 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 529 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 530 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 531 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 532 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 533 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 534 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 535 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 536 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 537 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 538 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 539 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 540 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 541 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 542 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 543 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 544 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 545 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 546 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 547 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 548 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 549 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 550 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 551 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 552 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 553 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 554 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 555 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 556 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 557 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 558 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 559 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 560 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 561 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 562 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 563 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 564 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 565 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 566 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 567 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 568 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 569 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 570 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 571 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 572 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 573 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 574 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 575 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 576 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 577 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 578 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 579 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 580 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 581 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 582 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 583 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 584 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 585 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 586 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 587 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 588 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 589 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 590 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 591 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 592 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 593 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 594 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 595 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 596 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 597 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 598 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 599 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 600 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 601 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 602 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 603 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 604 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 605 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 606 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 607 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 608 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 609 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 610 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 611 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 612 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 613 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 614 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 615 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 616 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 617 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 618 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 619 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 620 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 621 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 622 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 623 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 624 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 625 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 626 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 627 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 628 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 629 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 630 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 631 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 632 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 633 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 634 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 635 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 636 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 637 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 638 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 639 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 640 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 641 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 642 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 643 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 644 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 645 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 646 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 647 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 648 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 649 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 650 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 651 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 652 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 653 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 654 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 655 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 656 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 657 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 658 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 659 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 660 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 661 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 662 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 663 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 664 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 665 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 666 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 667 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 668 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 669 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 670 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 671 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 672 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 673 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 674 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 675 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 676 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 677 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 678 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 679 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 680 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 681 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 682 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 683 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 684 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 685 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 686 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 687 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 688 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 689 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 690 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 691 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 692 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 693 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 694 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 695 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 696 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 697 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 698 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 699 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 700 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 701 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 702 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 703 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 704 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 705 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 706 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 707 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 708 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 709 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 710 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 711 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 712 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 713 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 714 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 715 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 716 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 717 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 718 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 719 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 720 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 721 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 722 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 723 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 724 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 725 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 726 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 727 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 728 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 729 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 730 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 731 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 732 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 733 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 734 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 735 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 736 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 737 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 738 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 739 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 740 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 741 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 742 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 743 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 744 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 745 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 746 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 747 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 748 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 749 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 750 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 751 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 752 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 753 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 754 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 755 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 756 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 757 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 758 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 759 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 760 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 761 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 762 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 763 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 764 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 765 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 766 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 767 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 768 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 769 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 770 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 771 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 772 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 773 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 774 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 775 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 776 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 777 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 778 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 779 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 780 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 781 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 782 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 783 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 784 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 785 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 786 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 787 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 788 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 789 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 790 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 791 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 792 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 793 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 794 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 795 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 796 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 797 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 798 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 799 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 800 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 801 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 802 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 803 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 804 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 805 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 806 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 807 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 808 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 809 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 810 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 811 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 812 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 813 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 814 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 815 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 816 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 817 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 818 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 819 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 820 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 821 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 822 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 823 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 824 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 825 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 826 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 827 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 828 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 829 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 830 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 831 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 832 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 833 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 834 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 835 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 836 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 837 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 838 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 839 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 840 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 841 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 842 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 843 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 844 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 845 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 846 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 847 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 848 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 849 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 850 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 851 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 852 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 853 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 854 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 855 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 856 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 857 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 858 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 859 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 860 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 861 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 862 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 863 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 864 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 865 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 866 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 867 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 868 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 869 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 870 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 871 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 872 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 873 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 874 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 875 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 876 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 877 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 878 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 879 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 880 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 881 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 882 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 883 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 884 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 885 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 886 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 887 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 888 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 889 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 890 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 891 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 892 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 893 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 894 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 895 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 896 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 897 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 898 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 899 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 900 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 901 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 902 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 903 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 904 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 905 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 906 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 907 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 908 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 909 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 910 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 911 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 912 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 913 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 914 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 915 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 916 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 917 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 918 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 919 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 920 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 921 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 922 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 923 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 924 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 925 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 926 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 927 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 928 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 929 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 930 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 931 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 932 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 933 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 934 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 935 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 936 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 937 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 938 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 939 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 940 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 941 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 942 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 943 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 944 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 945 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 946 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 947 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 948 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 949 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 950 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 951 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 952 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 953 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 954 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 955 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 956 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 957 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 958 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 959 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 960 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 961 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 962 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 963 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 964 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 965 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 966 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 967 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 968 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 969 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 970 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 971 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 972 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 973 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 974 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 975 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 976 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 977 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 978 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 979 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 980 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 981 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 982 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 983 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 984 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 985 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 986 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 987 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 988 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 989 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 990 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 991 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 992 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 993 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 994 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 995 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 996 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 997 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 998 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 999 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1000 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1001 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1002 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1003 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1004 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1005 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1006 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1007 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1008 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1009 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1010 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1011 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1012 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1013 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1014 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1015 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1016 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1017 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1018 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1019 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1020 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1021 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1022 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1023 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1024 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1025 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1026 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1027 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1028 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1029 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1030 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1031 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1032 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1033 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1034 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1035 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1036 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1037 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1040 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1041 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1042 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1043 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1044 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1045 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1046 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1047 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1048 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1049 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1050 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1051 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1052 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1053 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1054 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1055 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1056 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1057 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1058 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1059 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1060 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1061 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1062 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1063 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1064 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1065 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1066 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1067 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1068 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1069 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1070 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1071 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1072 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1073 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1074 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1075 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1076 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1077 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1078 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1079 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1080 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1081 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1082 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1083 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1084 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1085 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1086 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1087 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1088 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1089 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1090 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1091 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1092 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1093 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1094 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1095 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1096 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1097 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1098 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1099 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1100 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1101 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1102 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1103 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1104 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1105 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1106 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1107 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1108 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1109 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1110 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1111 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1112 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1113 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1114 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1115 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1116 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1117 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1118 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1119 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1120 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1121 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1122 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1123 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1124 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1125 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1126 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1127 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1128 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1129 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1130 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1131 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1132 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1133 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1134 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1135 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1136 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1137 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1138 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1139 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1140 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1141 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1142 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1143 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1144 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1145 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1146 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1147 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1148 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1149 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1150 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1151 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1152 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1153 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1154 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1155 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1156 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1157 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1158 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1159 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1160 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1161 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1162 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1163 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1164 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1165 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1166 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1167 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1168 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1169 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1170 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1171 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1172 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1173 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1174 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1175 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1176 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1177 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1178 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1179 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1180 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1181 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1182 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1183 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1184 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1185 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1186 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1187 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1188 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1189 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1190 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1191 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1192 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1193 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1194 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1195 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1196 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1197 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1198 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1199 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1200 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1201 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1202 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1203 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1204 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1205 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1206 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1207 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1208 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1209 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1210 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1211 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1212 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1213 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1214 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1215 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1216 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1217 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1218 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1219 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1220 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1221 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1222 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1223 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1224 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1225 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1226 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1227 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1228 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1229 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1230 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1231 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1232 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1233 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1234 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1235 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1236 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1237 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1238 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1239 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1240 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1241 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1242 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1243 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1244 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1245 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1246 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1247 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1248 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1249 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1250 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1251 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1252 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1253 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1254 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1255 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1256 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1257 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1258 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1259 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1260 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1261 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1262 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1263 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1264 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1265 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1266 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1267 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1268 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1269 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1270 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1271 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1272 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1273 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1274 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1275 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1276 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1277 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1278 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1279 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1280 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1281 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1282 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1283 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1284 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1285 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1286 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1287 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1288 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1289 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1290 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1291 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1292 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1293 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1294 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1295 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1296 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1297 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1298 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1299 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1300 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1301 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1302 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1303 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1304 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1305 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1306 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1307 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1308 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1309 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1310 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1311 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1312 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1313 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1314 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1315 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1316 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1317 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1318 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1319 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1320 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1321 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1322 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1323 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1324 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1325 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1326 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1327 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1328 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1329 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1330 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1331 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1332 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1333 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1334 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1335 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1336 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1337 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1338 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1339 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1340 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1341 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1342 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1343 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1344 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1345 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1346 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1347 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1348 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1349 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1350 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1351 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1352 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1353 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1354 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1355 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1356 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1357 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1358 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1359 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1360 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1361 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1362 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1363 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1364 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1365 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1366 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1367 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1368 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1369 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1370 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1371 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1372 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1373 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1374 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1375 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1376 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1377 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1378 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1379 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1380 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1381 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1382 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1383 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1384 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1385 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1386 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1387 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1388 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1389 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1390 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1391 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1392 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1393 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1394 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1395 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1396 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1397 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1398 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1399 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1400 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1401 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1402 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1403 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1404 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1405 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1406 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1407 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1408 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1409 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1410 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1411 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1412 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1413 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1414 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1415 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1416 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1417 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1418 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1419 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1420 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1421 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1422 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1423 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1424 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1425 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1426 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1427 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1428 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1429 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1430 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1431 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1432 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1433 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1434 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1435 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1436 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1437 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1438 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1439 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1440 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1441 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1442 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1443 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1444 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1445 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1446 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1447 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1448 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1449 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1450 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1451 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1452 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1453 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1454 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1455 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1456 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1457 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1458 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1459 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1460 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1461 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1462 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1463 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1464 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1465 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1466 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1467 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1468 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1469 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1470 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1471 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1472 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1473 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1474 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1475 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1476 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1477 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1478 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1479 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1480 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1481 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1482 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1483 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1484 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1485 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1486 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1487 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1488 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1489 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1490 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1491 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1492 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1493 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1494 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1495 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1496 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1497 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1498 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1499 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1500 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1501 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1502 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1503 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1504 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1505 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1506 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1507 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1508 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1509 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1510 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1511 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1512 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1513 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1514 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1515 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1516 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1517 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1518 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1519 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1520 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1521 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1522 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1523 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1524 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1525 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1526 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1527 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1528 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1529 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1530 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1531 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1532 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1533 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1534 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1535 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1536 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1537 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1538 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1539 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1540 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1541 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1542 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1543 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1544 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1545 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1546 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1547 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1548 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1549 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1550 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1551 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1552 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1553 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1554 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1555 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1556 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1557 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1558 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1559 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1560 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1561 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1562 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1563 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1564 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1565 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1566 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1567 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1568 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1569 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1570 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1571 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1572 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1573 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1574 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1575 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1576 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1577 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1578 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1579 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1580 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1581 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1582 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1583 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1584 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1585 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1586 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1587 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1588 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1589 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1590 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1591 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1592 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1593 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1594 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1595 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1596 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1597 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1598 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1599 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1600 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1601 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1602 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1603 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1604 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1605 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1606 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1607 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1608 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1609 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1610 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1611 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1612 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1613 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1614 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1615 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1616 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1617 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1618 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1619 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1620 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1621 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1622 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1623 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1624 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1625 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1626 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1627 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1628 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1629 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1630 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1631 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1632 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1633 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1634 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1635 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1636 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1637 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1638 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1639 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1640 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1641 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1642 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1643 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1644 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1645 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1646 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1647 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1648 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1649 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1650 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1651 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1652 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1653 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1654 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1655 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1656 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1657 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1658 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1659 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1660 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1661 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1662 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1663 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1664 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1665 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1666 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1667 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1668 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1669 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1670 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1671 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1672 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1673 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1674 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1675 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1676 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1677 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1678 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1679 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1680 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1681 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1682 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1683 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1684 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1685 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1686 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1687 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1688 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1689 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1690 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1691 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1692 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1693 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1694 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1695 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1696 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1697 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1698 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1699 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1700 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1701 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1702 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1703 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1704 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1705 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1706 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1707 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1708 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1709 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1710 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1711 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1712 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1713 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1714 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1715 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1716 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1717 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1718 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1719 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1720 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1721 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1722 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1723 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1724 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1725 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1726 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1727 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1728 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1729 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1730 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1731 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1732 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1733 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1734 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1735 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1736 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1737 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1738 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1739 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1740 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1741 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1742 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1743 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1744 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1745 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1746 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1747 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1748 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1749 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1750 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1751 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1752 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1753 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1754 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1755 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1756 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1757 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1758 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1759 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1760 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1761 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1762 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1763 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1764 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1765 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1766 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1767 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1768 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1769 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1770 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1771 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1772 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1773 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1774 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1775 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1776 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1777 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1778 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1779 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1780 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1781 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1782 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1783 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1784 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1785 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1786 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1787 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1788 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1789 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1790 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1791 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1792 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1793 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1794 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1795 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1796 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1797 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1798 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1799 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1800 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1801 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1802 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1803 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1804 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1805 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1806 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1807 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1808 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1809 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1810 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1811 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1812 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1813 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1814 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1815 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1816 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1817 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1818 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1819 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1820 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1821 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1822 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1823 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1824 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1825 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1826 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1827 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1828 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1829 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1830 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1831 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1832 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1833 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1834 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1835 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1836 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1837 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1838 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1839 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1840 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1841 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1842 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1843 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1844 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1845 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1846 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1847 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1848 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1849 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1850 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1851 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1852 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1853 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1854 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1855 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1856 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1857 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1858 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1859 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1860 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1861 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1862 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1863 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1864 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1865 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1866 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1867 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1868 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1869 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1870 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1871 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1872 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1873 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1874 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1875 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1876 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1877 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1878 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1879 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1880 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1881 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1882 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1883 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1884 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1885 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1886 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1887 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1888 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1889 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1890 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1891 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1892 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1893 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1894 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1895 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1896 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1897 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1898 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1899 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1900 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1901 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1902 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1903 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1904 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1905 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1906 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1907 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1908 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1909 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1910 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1911 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1912 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1913 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1914 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1915 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1916 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1917 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1918 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1919 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1920 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1921 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1922 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1923 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1924 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1925 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1926 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1927 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1928 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1929 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1930 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1931 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1932 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1933 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1934 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1935 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1936 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1937 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1938 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1939 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1940 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1941 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1942 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1943 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1944 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1945 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1946 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1947 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1948 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1949 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1950 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1951 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1952 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1953 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1954 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1955 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1956 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1957 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1958 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1959 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1960 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1961 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1962 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1963 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1964 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1965 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1966 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1967 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1968 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1969 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1970 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1971 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1972 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1973 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1974 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1975 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1976 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1977 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1978 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1979 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1980 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1981 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1982 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1983 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1984 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1985 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1986 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1987 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1988 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1989 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1990 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1991 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1992 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1993 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1994 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1995 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1996 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1997 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1998 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 1999 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 2000 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 2001 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 2002 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Region: id = 2003 start_va = 0x1e40000 end_va = 0x234ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e40000" filename = "" Thread: id = 1 os_tid = 0xe44 [0028.144] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74f40000 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="WriteFile") returned 0x74f66590 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="SetFilePointer") returned 0x74f66530 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="SetEndOfFile") returned 0x74f664f0 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="ReadFile") returned 0x74f664a0 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="MoveFileA") returned 0x74f5c240 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="LockResource") returned 0x74f57a50 [0028.145] GetProcAddress (hModule=0x74f40000, lpProcName="LoadResource") returned 0x74f578f0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleFileNameA") returned 0x74f5a040 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="GetFileSize") returned 0x74f66360 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="GetFileAttributesA") returned 0x74f66310 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="GetCommandLineA") returned 0x74f5a3c0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="FreeResource") returned 0x74f5d8b0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="FreeLibrary") returned 0x74f598f0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="FindResourceA") returned 0x74f5b1d0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="FindNextFileA") returned 0x74f66270 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="FindFirstFileA") returned 0x74f66210 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="FindClose") returned 0x74f661d0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteFileA") returned 0x74f661a0 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="CreateFileA") returned 0x74f66170 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="CloseHandle") returned 0x74f65f20 [0028.146] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74f40000 [0028.146] GetProcAddress (hModule=0x74f40000, lpProcName="TlsSetValue") returned 0x74f51da0 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="TlsGetValue") returned 0x74f51ba0 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="LocalAlloc") returned 0x74f58840 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleHandleA") returned 0x74f59640 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleFileNameA") returned 0x74f5a040 [0028.147] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74f40000 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="GetCurrentThreadId") returned 0x74f51b90 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="DeleteCriticalSection") returned 0x77709920 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="LeaveCriticalSection") returned 0x776f5e00 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="EnterCriticalSection") returned 0x776f5e80 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="InitializeCriticalSection") returned 0x777095f0 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualFree") returned 0x74f58c70 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualAlloc") returned 0x74f58b70 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="LocalFree") returned 0x74f587c0 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="LocalAlloc") returned 0x74f58840 [0028.147] GetProcAddress (hModule=0x74f40000, lpProcName="VirtualQuery") returned 0x74f58c90 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="lstrlenA") returned 0x74f63a30 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="lstrcpyA") returned 0x74f5e320 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="LoadLibraryExA") returned 0x74f59f60 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="GetThreadLocale") returned 0x74f5a4e0 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="GetStartupInfoA") returned 0x74f59730 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="GetModuleFileNameA") returned 0x74f5a040 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="GetLocaleInfoA") returned 0x74f5e240 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="GetLastError") returned 0x74f52db0 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="GetCommandLineA") returned 0x74f5a3c0 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="FreeLibrary") returned 0x74f598f0 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="ExitProcess") returned 0x74f674f0 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="WriteFile") returned 0x74f66590 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="SetFilePointer") returned 0x74f66530 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="SetEndOfFile") returned 0x74f664f0 [0028.148] GetProcAddress (hModule=0x74f40000, lpProcName="RtlUnwind") returned 0x74f59a80 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="ReadFile") returned 0x74f664a0 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="RaiseException") returned 0x74f59ec0 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="GetStdHandle") returned 0x74f5a060 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="GetFileSize") returned 0x74f66360 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="GetSystemTime") returned 0x74f64a60 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="GetFileType") returned 0x74f66390 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="CreateFileA") returned 0x74f66170 [0028.149] GetProcAddress (hModule=0x74f40000, lpProcName="CloseHandle") returned 0x74f65f20 [0028.149] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77550000 [0028.149] GetProcAddress (hModule=0x77550000, lpProcName="RegQueryValueExA") returned 0x7756ee40 [0028.149] GetProcAddress (hModule=0x77550000, lpProcName="RegOpenKeyExA") returned 0x7756f000 [0028.149] GetProcAddress (hModule=0x77550000, lpProcName="RegCloseKey") returned 0x7756efa0 [0028.149] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x770d0000 [0028.149] GetProcAddress (hModule=0x770d0000, lpProcName="VariantCopyInd") returned 0x770e4570 [0028.149] GetProcAddress (hModule=0x770d0000, lpProcName="VariantClear") returned 0x770e92e0 [0028.150] GetProcAddress (hModule=0x770d0000, lpProcName="SysFreeString") returned 0x770e9230 [0028.150] GetProcAddress (hModule=0x770d0000, lpProcName="SysReAllocStringLen") returned 0x770f3ee0 [0028.150] GetProcAddress (hModule=0x770d0000, lpProcName="SysAllocStringLen") returned 0x770e91a0 [0028.150] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75310000 [0028.150] GetProcAddress (hModule=0x75310000, lpProcName="SHFileOperationA") returned 0x755616a0 [0028.150] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c70000 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="TranslateMessage") returned 0x76c8b9d0 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="MessageBoxA") returned 0x76cecf50 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="LoadIconA") returned 0x76ca1ec0 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="GetMessageA") returned 0x76c9cae0 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="DispatchMessageA") returned 0x76ca0660 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="CharLowerA") returned 0x76ca2b90 [0028.150] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c70000 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="GetKeyboardType") returned 0x76cc8670 [0028.150] GetProcAddress (hModule=0x76c70000, lpProcName="MessageBoxA") returned 0x76cecf50 [0028.150] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0028.151] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19fe4c, nSize=0x105 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\pony.exe")) returned 0x26 [0028.151] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19fd27, nSize=0x105 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\pony.exe")) returned 0x26 [0028.151] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19fe3c | out: phkResult=0x19fe3c*=0x0) returned 0x2 [0028.151] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19fe3c | out: phkResult=0x19fe3c*=0x0) returned 0x2 [0028.151] lstrcpyA (in: lpString1=0x19fd27, lpString2="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe" | out: lpString1="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe") returned="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe" [0028.151] GetThreadLocale () returned 0x409 [0028.151] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19fe37, cchData=5 | out: lpLCData="ENU") returned 4 [0028.151] lstrlenA (lpString="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe") returned 38 [0028.151] lstrcpyA (in: lpString1=0x19fd4a, lpString2="ENU" | out: lpString1="ENU") returned="ENU" [0028.151] LoadLibraryExA (lpLibFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.152] lstrcpyA (in: lpString1=0x19fd4a, lpString2="EN" | out: lpString1="EN") returned="EN" [0028.152] LoadLibraryExA (lpLibFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0028.152] GetKeyboardType (nTypeFlag=0) returned 4 [0028.152] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe\" " [0028.152] GetStartupInfoA (in: lpStartupInfo=0x19fee0 | out: lpStartupInfo=0x19fee0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0028.152] GetCurrentThreadId () returned 0xe44 [0028.152] GetSystemTime (in: lpSystemTime=0x19ff1c | out: lpSystemTime=0x19ff1c*(wYear=0x7e3, wMonth=0x2, wDayOfWeek=0x2, wDay=0x5, wHour=0xd, wMinute=0x13, wSecond=0x35, wMilliseconds=0x20)) [0028.152] GetCommandLineA () returned="\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\pony.exe\" " [0028.152] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x53aa90 [0028.152] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1d40000 [0028.152] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x538d38 [0028.152] VirtualAlloc (lpAddress=0x1d40000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d40000 [0028.153] LoadIconA (hInstance=0x400000, lpIconName="ICON0") returned 0x900b3 [0028.154] FindResourceA (hModule=0x400000, lpName="Str1", lpType=0x64) returned 0x4171b0 [0028.154] LoadResource (hModule=0x400000, hResInfo=0x4171b0) returned 0x413e0c [0028.154] LockResource (hResData=0x413e0c) returned 0x413e0c [0028.154] FreeResource (hResData=0x413e0c) returned 0 [0028.155] VirtualAlloc (lpAddress=0x1d44000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d44000 [0028.155] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x19fda4 | out: lpFindFileData=0x19fda4) returned 0x535140 [0028.155] FindNextFileA (in: hFindFile=0x535140, lpFindFileData=0x19fda4 | out: lpFindFileData=0x19fda4) returned 1 [0028.155] FindNextFileA (in: hFindFile=0x535140, lpFindFileData=0x19fda4 | out: lpFindFileData=0x19fda4) returned 1 [0028.155] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 0x534f00 [0028.156] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0028.156] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0028.156] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534e00 [0028.157] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0028.157] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0028.157] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5353c0 [0028.177] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0028.177] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0028.177] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.007.20033\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0028.180] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0028.180] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0028.180] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0028.180] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0028.180] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_15.023.20070\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0028.180] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0028.180] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0028.180] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0028.180] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0028.180] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.009.20058\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534ec0 [0028.205] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0028.205] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0028.205] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0028.207] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0028.207] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0028.246] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0028.247] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0028.247] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0028.311] CreateFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0028.370] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x166b000 [0028.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0028.370] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0028.377] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0028.462] ReadFile (in: hFile=0x18c, lpBuffer=0x1d44e1c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesRead=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0028.775] WriteFile (in: hFile=0x190, lpBuffer=0x1d44e1c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesWritten=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0028.906] ReadFile (in: hFile=0x18c, lpBuffer=0x1d44e1c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesRead=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0029.061] WriteFile (in: hFile=0x190, lpBuffer=0x1d44e1c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesWritten=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0029.239] ReadFile (in: hFile=0x18c, lpBuffer=0x1d44e1c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesRead=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0029.420] WriteFile (in: hFile=0x190, lpBuffer=0x1d44e1c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesWritten=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0029.526] ReadFile (in: hFile=0x18c, lpBuffer=0x1d44e1c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesRead=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0030.019] WriteFile (in: hFile=0x190, lpBuffer=0x1d44e1c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesWritten=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0030.121] ReadFile (in: hFile=0x18c, lpBuffer=0x1d44e1c, nNumberOfBytesToRead=0x26b000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesRead=0x19f17c*=0x26b000, lpOverlapped=0x0) returned 1 [0030.255] WriteFile (in: hFile=0x190, lpBuffer=0x1d44e1c*, nNumberOfBytesToWrite=0x26b010, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d44e1c*, lpNumberOfBytesWritten=0x19f17c*=0x26b010, lpOverlapped=0x0) returned 1 [0030.295] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0030.311] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0030.315] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0030.321] CloseHandle (hObject=0x18c) returned 1 [0030.321] CloseHandle (hObject=0x190) returned 1 [0030.712] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp"), lpNewFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0030.713] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0030.713] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534dc0 [0030.713] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0030.713] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0030.713] DeleteFileA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp")) returned 1 [0030.717] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_17.012.20098\\AcroRdrDCUpd1800920044_incr.msp" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_17.012.20098\\acrordrdcupd1800920044_incr.msp")) returned 0xffffffff [0030.717] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0030.718] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0030.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\S\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0030.718] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0030.718] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0030.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535000 [0030.718] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0030.718] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0030.718] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0030.718] FindClose (in: hFindFile=0x534e00 | out: hFindFile=0x534e00) returned 1 [0030.718] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0030.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0xffffffff [0030.719] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0030.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Comms\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x535340 [0030.719] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0030.719] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0030.719] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0030.719] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0030.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0xffffffff [0030.719] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0030.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0xffffffff [0030.719] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0030.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534e00 [0030.719] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0030.719] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0030.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534f40 [0030.720] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0030.720] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0030.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535080 [0030.802] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0030.802] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0030.802] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0030.879] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0030.879] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0030.879] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0030.880] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0030.880] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0030.880] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0030.881] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd77c4 [0030.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0030.881] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0030.888] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0030.921] ReadFile (in: hFile=0x18c, lpBuffer=0x1d45640, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d45640*, lpNumberOfBytesRead=0x19ef14*=0xd77c4, lpOverlapped=0x0) returned 1 [0031.123] WriteFile (in: hFile=0x194, lpBuffer=0x1d45640*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d45640*, lpNumberOfBytesWritten=0x19ef14*=0xd77d0, lpOverlapped=0x0) returned 1 [0031.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0031.205] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0031.210] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0031.217] CloseHandle (hObject=0x18c) returned 1 [0031.217] CloseHandle (hObject=0x194) returned 1 [0031.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0031.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0031.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0031.231] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0031.231] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0031.231] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0031.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\en-us.16\\stream.x64.en-us.man.dat")) returned 0xffffffff [0031.237] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0031.238] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0031.238] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0031.238] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0031.304] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0031.304] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0031.304] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0031.305] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0031.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0031.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0031.306] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38480a [0031.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0031.306] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0031.316] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0031.363] ReadFile (in: hFile=0x194, lpBuffer=0x1d458a4, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d458a4*, lpNumberOfBytesRead=0x19ef14*=0x38480a, lpOverlapped=0x0) returned 1 [0033.059] WriteFile (in: hFile=0x18c, lpBuffer=0x1d458a4*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d458a4*, lpNumberOfBytesWritten=0x19ef14*=0x384810, lpOverlapped=0x0) returned 1 [0033.107] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0033.122] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0033.126] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0033.132] CloseHandle (hObject=0x194) returned 1 [0033.133] CloseHandle (hObject=0x18c) returned 1 [0033.219] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0033.219] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0033.220] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534cc0 [0033.220] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0033.220] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0033.220] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0033.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\8C296B8E-6699-457C-9415-3D0647E1D775\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\8c296b8e-6699-457c-9415-3d0647e1d775\\x-none.16\\stream.x64.x-none.man.dat")) returned 0xffffffff [0033.224] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0033.224] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0033.224] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0033.224] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0033.224] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0033.224] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535000 [0033.261] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0033.261] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0033.261] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0033.348] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.349] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.349] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.349] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.349] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0033.350] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0033.467] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd77c4 [0033.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0033.467] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0033.478] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0033.511] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46918, nNumberOfBytesToRead=0xd77c4, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46918*, lpNumberOfBytesRead=0x19ef14*=0xd77c4, lpOverlapped=0x0) returned 1 [0033.540] WriteFile (in: hFile=0x194, lpBuffer=0x1d46918*, nNumberOfBytesToWrite=0xd77d0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46918*, lpNumberOfBytesWritten=0x19ef14*=0xd77d0, lpOverlapped=0x0) returned 1 [0033.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0033.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0033.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0033.589] CloseHandle (hObject=0x18c) returned 1 [0033.589] CloseHandle (hObject=0x194) returned 1 [0033.625] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0033.626] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0033.626] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534ec0 [0033.626] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0033.626] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0033.626] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0033.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\en-us.16\\stream.x64.en-us.man.dat")) returned 0xffffffff [0033.632] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0033.632] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0033.632] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0033.632] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e80 [0033.644] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.644] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.644] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.645] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0033.645] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0033.645] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0033.646] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38480a [0033.646] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0033.646] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0033.653] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0033.693] ReadFile (in: hFile=0x194, lpBuffer=0x1d46c3c, nNumberOfBytesToRead=0x38480a, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c3c*, lpNumberOfBytesRead=0x19ef14*=0x38480a, lpOverlapped=0x0) returned 1 [0033.873] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46c3c*, nNumberOfBytesToWrite=0x384810, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c3c*, lpNumberOfBytesWritten=0x19ef14*=0x384810, lpOverlapped=0x0) returned 1 [0033.925] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0033.940] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0033.944] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0033.950] CloseHandle (hObject=0x194) returned 1 [0033.951] CloseHandle (hObject=0x18c) returned 1 [0034.045] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0034.046] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0034.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534dc0 [0034.046] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0034.046] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0034.046] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0034.052] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9D76938C-943D-439F-A135-26D02821EE05\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9d76938c-943d-439f-a135-26d02821ee05\\x-none.16\\stream.x64.x-none.man.dat")) returned 0xffffffff [0034.052] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0034.052] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0034.052] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0034.052] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0034.052] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.052] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.053] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.053] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.053] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534d00 [0034.053] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.054] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.054] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0034.054] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.054] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.054] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0034.054] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.054] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.054] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0034.054] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0034.054] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0034.054] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0034.055] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0034.055] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0034.055] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0034.056] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0034.056] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0034.057] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0034.057] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0034.057] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0034.057] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0034.057] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.057] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0034.058] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0034.058] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0034.058] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0034.058] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0034.058] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535000 [0034.058] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0034.058] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.058] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0034.059] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.059] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.060] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.060] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.061] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.061] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.061] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0034.061] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0034.062] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104881 [0034.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0034.062] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0034.069] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0034.105] ReadFile (in: hFile=0x194, lpBuffer=0x1d46e30, nNumberOfBytesToRead=0x104881, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e30*, lpNumberOfBytesRead=0x19ecac*=0x104881, lpOverlapped=0x0) returned 1 [0034.154] WriteFile (in: hFile=0x198, lpBuffer=0x1d46e30*, nNumberOfBytesToWrite=0x104890, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e30*, lpNumberOfBytesWritten=0x19ecac*=0x104890, lpOverlapped=0x0) returned 1 [0034.181] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0034.196] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0034.199] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.206] CloseHandle (hObject=0x194) returned 1 [0034.206] CloseHandle (hObject=0x198) returned 1 [0034.268] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0034.268] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0034.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0034.269] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0034.269] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0034.269] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat")) returned 1 [0034.270] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\en-us.16\\stream.x64.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\en-us.16\\stream.x64.en-us.man.dat")) returned 0xffffffff [0034.270] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0034.270] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0034.270] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0034.270] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534ec0 [0034.271] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.271] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.271] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.272] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.272] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.273] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0034.273] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0034.273] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0034.274] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52f610 [0034.274] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0034.274] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0034.282] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0034.327] ReadFile (in: hFile=0x198, lpBuffer=0x1d4702c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4702c*, lpNumberOfBytesRead=0x19ecac*=0x500000, lpOverlapped=0x0) returned 1 [0034.555] WriteFile (in: hFile=0x194, lpBuffer=0x1d4702c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4702c*, lpNumberOfBytesWritten=0x19ecac*=0x500000, lpOverlapped=0x0) returned 1 [0034.625] ReadFile (in: hFile=0x198, lpBuffer=0x1d4702c, nNumberOfBytesToRead=0x2f610, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4702c*, lpNumberOfBytesRead=0x19ecac*=0x2f610, lpOverlapped=0x0) returned 1 [0034.633] WriteFile (in: hFile=0x194, lpBuffer=0x1d4702c*, nNumberOfBytesToWrite=0x2f620, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4702c*, lpNumberOfBytesWritten=0x19ecac*=0x2f620, lpOverlapped=0x0) returned 1 [0034.638] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0034.655] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0034.664] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0034.672] CloseHandle (hObject=0x198) returned 1 [0034.672] CloseHandle (hObject=0x194) returned 1 [0034.843] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0034.844] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0034.844] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0034.844] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0034.844] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0034.844] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat")) returned 1 [0034.846] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\ProductReleases\\46750A92-D768-415D-ABAC-A9B18903B159\\x-none.16\\stream.x64.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\productreleases\\46750a92-d768-415d-abac-a9b18903b159\\x-none.16\\stream.x64.x-none.man.dat")) returned 0xffffffff [0034.847] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0034.847] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0034.847] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0034.847] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0034.847] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0034.847] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0034.847] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.847] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535200 [0034.847] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.847] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0034.847] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0034.847] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0034.847] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535240 [0034.865] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.994] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.995] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.995] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.996] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.997] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.998] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.998] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0034.999] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.000] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.001] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.001] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.002] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.003] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.004] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.005] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.005] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.006] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.007] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.008] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.008] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.009] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.010] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.011] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.016] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.017] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.028] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.028] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.029] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.030] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.031] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.032] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.032] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.033] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.034] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.035] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.036] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.036] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.037] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.038] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.038] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.039] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.040] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.041] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.042] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.042] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.043] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.044] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.044] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.044] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0035.045] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0035.045] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0035.045] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0035.045] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535340 [0035.046] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0035.046] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534d00 [0035.046] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0035.046] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.046] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0035.046] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535040 [0035.049] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.049] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.049] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0035.049] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.049] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0035.049] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.049] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.049] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535380 [0035.049] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.049] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0035.049] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0035.050] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.050] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0035.050] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.050] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0035.050] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.050] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.050] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535380 [0035.051] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.051] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0035.051] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0035.051] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.051] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0035.053] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.053] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.053] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0035.053] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0035.054] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.054] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0035.054] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.054] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0035.054] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.054] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.055] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.055] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0035.055] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0035.055] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0035.055] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0035.055] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534c80 [0035.055] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.055] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.055] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0035.055] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.055] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.056] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0035.056] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0035.056] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0035.056] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0035.056] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5351c0 [0035.058] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.058] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534c80 [0035.058] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.058] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.058] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0035.088] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.088] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.089] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.092] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.095] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0035.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.095] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.104] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0035.149] ReadFile (in: hFile=0x18c, lpBuffer=0x1d47070, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesRead=0x19ef14*=0x1fad1, lpOverlapped=0x0) returned 1 [0035.164] WriteFile (in: hFile=0x194, lpBuffer=0x1d47070*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesWritten=0x19ef14*=0x1fae0, lpOverlapped=0x0) returned 1 [0035.166] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0035.181] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0035.185] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.193] CloseHandle (hObject=0x18c) returned 1 [0035.193] CloseHandle (hObject=0x194) returned 1 [0035.196] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0035.196] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0035.196] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e40 [0035.196] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0035.196] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0035.196] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0035.197] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0035.197] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.198] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.198] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.200] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.202] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadc8 [0035.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.202] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.209] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0035.246] ReadFile (in: hFile=0x194, lpBuffer=0x1d46164, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46164*, lpNumberOfBytesRead=0x19ef14*=0xadc8, lpOverlapped=0x0) returned 1 [0035.295] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46164*, nNumberOfBytesToWrite=0xadd0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46164*, lpNumberOfBytesWritten=0x19ef14*=0xadd0, lpOverlapped=0x0) returned 1 [0035.296] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0035.311] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0035.315] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.322] CloseHandle (hObject=0x194) returned 1 [0035.322] CloseHandle (hObject=0x18c) returned 1 [0035.323] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0035.324] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0035.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0035.324] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0035.324] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0035.324] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0 [0035.325] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0035.325] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.326] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0035.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.326] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.336] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0035.371] ReadFile (in: hFile=0x18c, lpBuffer=0x1d462dc, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d462dc*, lpNumberOfBytesRead=0x19ef14*=0x70c1, lpOverlapped=0x0) returned 1 [0035.403] WriteFile (in: hFile=0x194, lpBuffer=0x1d462dc*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d462dc*, lpNumberOfBytesWritten=0x19ef14*=0x70d0, lpOverlapped=0x0) returned 1 [0035.404] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0035.420] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0035.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.431] CloseHandle (hObject=0x18c) returned 1 [0035.431] CloseHandle (hObject=0x194) returned 1 [0035.432] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0035.433] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0035.433] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534f40 [0035.433] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0035.433] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0035.433] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0 [0035.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0035.434] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.434] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.435] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.435] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99d3 [0035.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.435] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.576] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0035.608] ReadFile (in: hFile=0x194, lpBuffer=0x1d46450, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46450*, lpNumberOfBytesRead=0x19ef14*=0x99d3, lpOverlapped=0x0) returned 1 [0035.630] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46450*, nNumberOfBytesToWrite=0x99e0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46450*, lpNumberOfBytesWritten=0x19ef14*=0x99e0, lpOverlapped=0x0) returned 1 [0035.632] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0035.647] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0035.650] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.657] CloseHandle (hObject=0x194) returned 1 [0035.657] CloseHandle (hObject=0x18c) returned 1 [0035.658] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0035.659] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0035.659] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0035.659] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0035.659] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0035.659] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0 [0035.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0035.660] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0035.660] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0035.660] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0035.660] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.660] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.661] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.661] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.662] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0035.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.663] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.669] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0035.711] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46728, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46728*, lpNumberOfBytesRead=0x19ef14*=0x1fad1, lpOverlapped=0x0) returned 1 [0035.714] WriteFile (in: hFile=0x194, lpBuffer=0x1d46728*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46728*, lpNumberOfBytesWritten=0x19ef14*=0x1fae0, lpOverlapped=0x0) returned 1 [0035.716] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0035.770] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0035.774] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.780] CloseHandle (hObject=0x18c) returned 1 [0035.780] CloseHandle (hObject=0x194) returned 1 [0035.782] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0035.783] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0035.783] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535040 [0035.783] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0035.783] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0035.783] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0035.784] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0035.784] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.785] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.785] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.785] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.819] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0035.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.820] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.835] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0035.886] ReadFile (in: hFile=0x194, lpBuffer=0x1d468b0, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d468b0*, lpNumberOfBytesRead=0x19ef14*=0x70c1, lpOverlapped=0x0) returned 1 [0035.894] WriteFile (in: hFile=0x18c, lpBuffer=0x1d468b0*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d468b0*, lpNumberOfBytesWritten=0x19ef14*=0x70d0, lpOverlapped=0x0) returned 1 [0035.895] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0035.913] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0035.916] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0035.923] CloseHandle (hObject=0x194) returned 1 [0035.923] CloseHandle (hObject=0x18c) returned 1 [0035.924] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0035.926] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0035.926] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0035.926] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0035.926] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0035.926] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0 [0035.927] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0035.927] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0035.927] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0035.927] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0035.927] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0035.927] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0035.927] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0035.932] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.932] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0035.932] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0035.934] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.934] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.934] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535340 [0035.934] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0035.934] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0035.935] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0035.935] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0035.935] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0035.935] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0035.942] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0035.943] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0035.943] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0035.943] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0035.950] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.005] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46c8c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c8c*, lpNumberOfBytesRead=0x19ef14*=0xd0a3, lpOverlapped=0x0) returned 1 [0036.017] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c8c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c8c*, lpNumberOfBytesWritten=0x19ef14*=0xd0b0, lpOverlapped=0x0) returned 1 [0036.024] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.040] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.044] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.053] CloseHandle (hObject=0x18c) returned 1 [0036.053] CloseHandle (hObject=0x194) returned 1 [0036.054] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.055] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.055] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535340 [0036.055] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.055] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0036.055] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0 [0036.056] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20 [0036.056] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.056] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.056] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.057] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72ee [0036.057] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.057] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.064] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.103] ReadFile (in: hFile=0x194, lpBuffer=0x1d46df0, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46df0*, lpNumberOfBytesRead=0x19ef14*=0x72ee, lpOverlapped=0x0) returned 1 [0036.120] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46df0*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46df0*, lpNumberOfBytesWritten=0x19ef14*=0x72f0, lpOverlapped=0x0) returned 1 [0036.121] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.137] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.140] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.148] CloseHandle (hObject=0x194) returned 1 [0036.148] CloseHandle (hObject=0x18c) returned 1 [0036.149] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.150] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.150] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0036.150] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.150] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0036.150] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0 [0036.151] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20 [0036.151] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.151] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.151] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.171] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14668 [0036.171] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.171] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.178] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.214] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46f5c, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f5c*, lpNumberOfBytesRead=0x19ef14*=0x14668, lpOverlapped=0x0) returned 1 [0036.217] WriteFile (in: hFile=0x194, lpBuffer=0x1d46f5c*, nNumberOfBytesToWrite=0x14670, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f5c*, lpNumberOfBytesWritten=0x19ef14*=0x14670, lpOverlapped=0x0) returned 1 [0036.219] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.235] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.238] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.245] CloseHandle (hObject=0x18c) returned 1 [0036.245] CloseHandle (hObject=0x194) returned 1 [0036.247] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.247] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0036.248] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.248] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0036.248] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0 [0036.248] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20 [0036.248] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.249] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.249] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.253] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.253] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcaa9 [0036.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.253] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.260] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.294] ReadFile (in: hFile=0x194, lpBuffer=0x1d47008, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ef14*=0xcaa9, lpOverlapped=0x0) returned 1 [0036.325] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0xcab0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ef14*=0xcab0, lpOverlapped=0x0) returned 1 [0036.326] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.342] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.345] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.352] CloseHandle (hObject=0x194) returned 1 [0036.352] CloseHandle (hObject=0x18c) returned 1 [0036.354] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.354] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534cc0 [0036.354] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.354] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0036.354] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0 [0036.355] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20 [0036.355] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.355] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.355] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.358] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10850 [0036.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.359] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.368] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.413] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46b40, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b40*, lpNumberOfBytesRead=0x19ef14*=0x10850, lpOverlapped=0x0) returned 1 [0036.416] WriteFile (in: hFile=0x194, lpBuffer=0x1d46b40*, nNumberOfBytesToWrite=0x10860, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b40*, lpNumberOfBytesWritten=0x19ef14*=0x10860, lpOverlapped=0x0) returned 1 [0036.417] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.435] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.444] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.453] CloseHandle (hObject=0x18c) returned 1 [0036.454] CloseHandle (hObject=0x194) returned 1 [0036.497] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.498] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0036.498] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.498] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0036.498] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0 [0036.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20 [0036.499] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.499] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc04b [0036.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.500] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.509] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.581] ReadFile (in: hFile=0x194, lpBuffer=0x1d46cb0, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46cb0*, lpNumberOfBytesRead=0x19ef14*=0xc04b, lpOverlapped=0x0) returned 1 [0036.745] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46cb0*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46cb0*, lpNumberOfBytesWritten=0x19ef14*=0xc050, lpOverlapped=0x0) returned 1 [0036.746] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.761] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.765] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.772] CloseHandle (hObject=0x194) returned 1 [0036.772] CloseHandle (hObject=0x18c) returned 1 [0036.773] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.773] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.773] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0036.774] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.774] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0036.774] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0 [0036.774] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20 [0036.774] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.775] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.775] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.791] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.793] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b9f4 [0036.793] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.793] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.800] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.888] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46e5c, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e5c*, lpNumberOfBytesRead=0x19ef14*=0x1b9f4, lpOverlapped=0x0) returned 1 [0036.903] WriteFile (in: hFile=0x194, lpBuffer=0x1d46e5c*, nNumberOfBytesToWrite=0x1ba00, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e5c*, lpNumberOfBytesWritten=0x19ef14*=0x1ba00, lpOverlapped=0x0) returned 1 [0036.905] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0036.921] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0036.925] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0036.931] CloseHandle (hObject=0x18c) returned 1 [0036.931] CloseHandle (hObject=0x194) returned 1 [0036.934] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0036.934] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0036.934] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0036.934] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0036.934] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0036.934] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0 [0036.935] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20 [0036.935] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0036.935] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0036.935] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0036.935] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0036.941] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.941] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.942] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0036.945] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0036.945] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0036.945] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0036.945] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0036.945] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0036.945] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0036.946] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0036.946] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0036.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0036.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0036.953] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0036.992] ReadFile (in: hFile=0x194, lpBuffer=0x1d47054, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesRead=0x19ef14*=0xd0a3, lpOverlapped=0x0) returned 1 [0036.994] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47054*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesWritten=0x19ef14*=0xd0b0, lpOverlapped=0x0) returned 1 [0036.995] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.010] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.014] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.026] CloseHandle (hObject=0x194) returned 1 [0037.026] CloseHandle (hObject=0x18c) returned 1 [0037.027] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.028] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0037.028] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.028] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0037.028] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0 [0037.029] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20 [0037.029] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.029] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.029] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0037.029] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3c8 [0037.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.030] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.054] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.088] ReadFile (in: hFile=0x18c, lpBuffer=0x1d47084, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ef14*=0xe3c8, lpOverlapped=0x0) returned 1 [0037.111] WriteFile (in: hFile=0x194, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0xe3d0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ef14*=0xe3d0, lpOverlapped=0x0) returned 1 [0037.113] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.128] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.131] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.138] CloseHandle (hObject=0x18c) returned 1 [0037.138] CloseHandle (hObject=0x194) returned 1 [0037.140] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.140] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.140] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534c80 [0037.140] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.140] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0037.140] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0 [0037.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20 [0037.141] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.141] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0037.142] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.142] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xebb8 [0037.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.142] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.166] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.224] ReadFile (in: hFile=0x194, lpBuffer=0x1d47038, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47038*, lpNumberOfBytesRead=0x19ef14*=0xebb8, lpOverlapped=0x0) returned 1 [0037.227] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47038*, nNumberOfBytesToWrite=0xebc0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47038*, lpNumberOfBytesWritten=0x19ef14*=0xebc0, lpOverlapped=0x0) returned 1 [0037.229] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.248] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.252] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.260] CloseHandle (hObject=0x194) returned 1 [0037.260] CloseHandle (hObject=0x18c) returned 1 [0037.262] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.262] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.263] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535040 [0037.263] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.263] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0037.263] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0 [0037.264] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20 [0037.264] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.264] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.264] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0037.267] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff5 [0037.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.268] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.274] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.310] ReadFile (in: hFile=0x18c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ef14*=0xdff5, lpOverlapped=0x0) returned 1 [0037.324] WriteFile (in: hFile=0x194, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0xe000, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ef14*=0xe000, lpOverlapped=0x0) returned 1 [0037.326] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.341] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.344] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.351] CloseHandle (hObject=0x18c) returned 1 [0037.352] CloseHandle (hObject=0x194) returned 1 [0037.353] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.354] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.354] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535340 [0037.354] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.354] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0037.354] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0 [0037.354] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20 [0037.354] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.355] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0037.355] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.383] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec75 [0037.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.383] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.391] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.448] ReadFile (in: hFile=0x194, lpBuffer=0x1d47044, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesRead=0x19ef14*=0xec75, lpOverlapped=0x0) returned 1 [0037.460] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47044*, nNumberOfBytesToWrite=0xec80, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesWritten=0x19ef14*=0xec80, lpOverlapped=0x0) returned 1 [0037.461] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.476] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.480] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.496] CloseHandle (hObject=0x194) returned 1 [0037.496] CloseHandle (hObject=0x18c) returned 1 [0037.497] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.498] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0037.498] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.498] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0037.498] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0 [0037.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20 [0037.498] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0037.499] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10654 [0037.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.500] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.506] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.567] ReadFile (in: hFile=0x18c, lpBuffer=0x1d47078, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesRead=0x19ef14*=0x10654, lpOverlapped=0x0) returned 1 [0037.577] WriteFile (in: hFile=0x194, lpBuffer=0x1d47078*, nNumberOfBytesToWrite=0x10660, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesWritten=0x19ef14*=0x10660, lpOverlapped=0x0) returned 1 [0037.579] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.594] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.598] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.604] CloseHandle (hObject=0x18c) returned 1 [0037.604] CloseHandle (hObject=0x194) returned 1 [0037.606] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0037.607] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.607] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0037.607] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0 [0037.607] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20 [0037.607] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0037.630] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.631] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8c2 [0037.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.631] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.638] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.671] ReadFile (in: hFile=0x194, lpBuffer=0x1d47030, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47030*, lpNumberOfBytesRead=0x19ef14*=0xf8c2, lpOverlapped=0x0) returned 1 [0037.677] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47030*, nNumberOfBytesToWrite=0xf8d0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47030*, lpNumberOfBytesWritten=0x19ef14*=0xf8d0, lpOverlapped=0x0) returned 1 [0037.678] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.693] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.697] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.704] CloseHandle (hObject=0x194) returned 1 [0037.704] CloseHandle (hObject=0x18c) returned 1 [0037.706] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.707] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534f40 [0037.707] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0037.707] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0037.707] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0 [0037.707] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20 [0037.707] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.708] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0037.708] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0037.708] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.708] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0037.708] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0037.708] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0037.708] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0037.708] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5353c0 [0037.708] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.708] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0037.708] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0037.708] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0037.708] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5353c0 [0037.719] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.719] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.719] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\AsimovUploader\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0037.720] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.720] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.720] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0037.720] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.720] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedScenarios\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0037.726] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.726] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.727] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.727] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.728] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.728] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.729] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.729] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.730] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.730] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.731] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.731] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.732] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.732] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0037.732] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.732] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0037.737] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.737] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.737] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\cfc.flights.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0037.737] CloseHandle (hObject=0xffffffff) returned 1 [0037.737] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\cfc.flights.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\cfc.flights.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.738] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\cfc.flights.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0037.738] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e40 [0037.738] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0037.738] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0037.738] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\cfc.flights.json")) returned 1 [0037.739] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\cfc.flights.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\cfc.flights.json")) returned 0xffffffff [0037.739] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.739] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0037.739] CloseHandle (hObject=0xffffffff) returned 1 [0037.739] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.740] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0037.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535040 [0037.740] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0037.740] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0037.740] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 1 [0037.740] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\telemetry.ASM-WindowsDefault.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\telemetry.asm-windowsdefault.json")) returned 0xffffffff [0037.741] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.741] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.741] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0037.741] CloseHandle (hObject=0xffffffff) returned 1 [0037.741] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0037.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535340 [0037.742] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0037.742] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0037.742] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 1 [0037.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\DownloadedSettings\\utc.app.json" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\downloadedsettings\\utc.app.json")) returned 0xffffffff [0037.743] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.743] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.743] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0037.743] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0037.743] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.743] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\AutoLogger\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0037.743] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.743] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.744] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0037.744] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0037.744] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\ETLLogs\\ShutdownLogger\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535080 [0037.746] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.746] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0037.746] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0037.746] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.746] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0037.746] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.746] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.747] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.748] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.748] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.748] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\LocalTraceStore\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534f40 [0037.748] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.748] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.748] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0037.748] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.748] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0037.749] CloseHandle (hObject=0xffffffff) returned 1 [0037.749] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.749] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0037.749] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534ec0 [0037.749] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0037.749] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0037.749] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat")) returned 1 [0037.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\parse.dat" (normalized: "c:\\users\\all users\\microsoft\\diagnosis\\parse.dat")) returned 0xffffffff [0037.750] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Sideload\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534d00 [0037.750] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.750] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.750] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0037.750] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\Siufloc\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0037.750] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.750] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.750] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0037.750] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLanding\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0037.756] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.756] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.756] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0037.756] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Diagnosis\\SoftLandingStage\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534f40 [0037.756] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.757] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.757] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0037.762] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0037.762] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0037.762] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0037.762] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534f40 [0037.763] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.763] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0037.763] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.763] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.763] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0037.763] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0037.763] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0037.763] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0037.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535400 [0037.766] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.766] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.766] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0037.781] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.781] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.781] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534ec0 [0037.784] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0037.784] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0037.784] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0037.784] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.784] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0037.784] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0037.784] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0037.784] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0037.784] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5351c0 [0037.786] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.786] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.786] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0037.786] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.786] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.786] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0037.788] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.788] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ed8 [0037.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.789] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.795] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.831] ReadFile (in: hFile=0x190, lpBuffer=0x1d466b8, nNumberOfBytesToRead=0x5ed8, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d466b8*, lpNumberOfBytesRead=0x19f17c*=0x5ed8, lpOverlapped=0x0) returned 1 [0037.861] WriteFile (in: hFile=0x18c, lpBuffer=0x1d466b8*, nNumberOfBytesToWrite=0x5ee0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d466b8*, lpNumberOfBytesWritten=0x19f17c*=0x5ee0, lpOverlapped=0x0) returned 1 [0037.881] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.898] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.901] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0037.909] CloseHandle (hObject=0x190) returned 1 [0037.910] CloseHandle (hObject=0x18c) returned 1 [0037.910] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0037.911] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0037.911] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535200 [0037.911] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0037.911] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0037.911] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll")) returned 1 [0037.913] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\INT\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\int\\ppcrlconfig600.dll")) returned 0xffffffff [0037.913] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0037.913] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0037.913] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0037.913] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535340 [0037.913] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.913] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0037.913] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0037.916] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0037.918] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60e0 [0037.918] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0037.919] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0037.926] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0037.963] ReadFile (in: hFile=0x18c, lpBuffer=0x1d466e0, nNumberOfBytesToRead=0x60e0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d466e0*, lpNumberOfBytesRead=0x19f17c*=0x60e0, lpOverlapped=0x0) returned 1 [0037.977] WriteFile (in: hFile=0x190, lpBuffer=0x1d466e0*, nNumberOfBytesToWrite=0x60f0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d466e0*, lpNumberOfBytesWritten=0x19f17c*=0x60f0, lpOverlapped=0x0) returned 1 [0037.978] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0037.994] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0037.998] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.017] CloseHandle (hObject=0x18c) returned 1 [0038.017] CloseHandle (hObject=0x190) returned 1 [0038.025] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0038.025] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0038.025] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e40 [0038.026] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0038.026] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0038.026] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll")) returned 1 [0038.027] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\ppcrlconfig600.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\production\\ppcrlconfig600.dll")) returned 0xffffffff [0038.027] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.027] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\production\\temp\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0038.027] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.027] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.027] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0038.028] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.028] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0038.028] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.028] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.028] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MapData\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535040 [0038.028] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.028] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.028] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0038.028] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534e80 [0038.028] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.028] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.029] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.029] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.029] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0038.029] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.029] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535340 [0038.029] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.029] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.029] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0038.030] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.030] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.030] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.030] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535340 [0038.030] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.030] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0038.030] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.030] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.030] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0038.030] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.030] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.031] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0038.031] CloseHandle (hObject=0xffffffff) returned 1 [0038.031] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0038.031] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0038.031] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x5351c0 [0038.031] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0038.032] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.032] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0 [0038.032] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0x20 [0038.032] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.032] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0038.032] CloseHandle (hObject=0xffffffff) returned 1 [0038.033] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0038.033] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0038.033] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e40 [0038.033] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0038.033] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0038.034] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0 [0038.034] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0x20 [0038.034] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.034] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0038.034] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.034] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0038.035] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.035] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534dc0 [0038.035] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.035] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.036] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.036] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0038.036] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.036] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535180 [0038.053] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.053] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.054] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.054] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0038.085] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.085] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.085] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.086] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.086] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0038.086] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.086] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.086] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0038.086] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.086] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.087] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.087] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.087] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0038.087] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.088] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.088] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0038.088] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.088] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.088] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.088] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534ec0 [0038.089] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.089] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.089] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.089] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.089] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0038.093] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.093] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.093] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0038.094] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.094] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.094] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.095] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.095] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0038.095] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.095] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.095] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0038.095] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.095] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0038.095] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.096] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0038.097] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.097] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.097] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.098] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.098] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535080 [0038.098] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.098] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.098] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0038.113] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.113] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.113] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.114] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.114] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0038.114] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.114] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.114] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0038.114] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.114] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.114] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.114] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0038.115] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.115] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.115] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.116] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.116] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0038.116] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.116] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.116] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0038.116] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.116] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.116] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.117] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.117] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.117] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.117] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.118] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.118] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0038.118] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.118] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0038.118] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.118] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534f40 [0038.120] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.120] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.121] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.121] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.121] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0038.121] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.121] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.121] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535340 [0038.121] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.121] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.122] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.122] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.123] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.123] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0038.123] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.124] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0038.124] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.124] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0038.124] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.124] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.124] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.125] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.125] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0038.126] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.126] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.126] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0038.127] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.127] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.127] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.128] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0038.128] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.128] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.128] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0038.128] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.128] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.128] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.128] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0038.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.130] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.130] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0038.130] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.130] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.130] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{99b095d8-5959-4820-bea7-7448c8427b4e}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0038.134] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.134] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.134] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.134] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0038.135] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.135] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.135] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.135] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.135] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0038.135] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.135] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0038.135] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.135] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.136] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.136] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.136] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0038.136] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.137] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.137] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535340 [0038.137] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.137] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.137] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.137] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0038.137] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.138] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.138] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0038.138] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.138] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0038.138] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.138] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e80 [0038.140] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.140] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.141] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.141] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0038.141] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.141] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0038.142] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.142] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.142] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.142] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.142] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0038.143] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.143] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.143] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.143] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.143] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0038.143] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0038.144] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.144] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.144] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.145] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.145] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535340 [0038.148] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.148] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.149] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0038.149] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.149] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.149] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.149] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0038.149] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.150] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.150] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0038.150] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.150] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.150] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.150] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e80 [0038.150] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.150] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.151] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.151] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535240 [0038.151] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.151] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.151] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{ee4aac98-c174-4941-82b1-d121e493e4fb}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0038.153] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.153] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.154] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.154] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0038.154] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.155] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.155] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0038.155] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.155] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0038.155] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.155] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0038.155] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.155] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.156] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.156] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0038.157] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.157] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.157] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0038.157] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.157] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.157] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.158] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.158] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0038.158] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.159] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.159] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.159] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.159] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0038.159] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.159] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5353c0 [0038.161] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.161] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.162] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.162] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.162] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0038.163] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.163] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.163] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\\Prov\\RunTime\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0038.165] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.165] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.166] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.166] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.167] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.168] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.168] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.169] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.169] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0038.169] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0038.170] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.170] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0038.170] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0038.177] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0038.177] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0038.178] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0038.179] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0038.179] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0038.179] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535200 [0038.179] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.179] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0038.179] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535000 [0038.179] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.179] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0038.179] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535040 [0038.180] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.180] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0038.180] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0038.215] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.215] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.215] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0038.216] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0038.216] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0038.216] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0038.217] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0038.218] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.219] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0038.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0038.219] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0038.227] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0038.269] ReadFile (in: hFile=0x194, lpBuffer=0x1d46ad0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ad0*, lpNumberOfBytesRead=0x19ecac*=0x2000, lpOverlapped=0x0) returned 1 [0038.277] WriteFile (in: hFile=0x198, lpBuffer=0x1d46ad0*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ad0*, lpNumberOfBytesWritten=0x19ecac*=0x2010, lpOverlapped=0x0) returned 1 [0038.278] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0038.302] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0038.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.316] CloseHandle (hObject=0x194) returned 1 [0038.316] CloseHandle (hObject=0x198) returned 1 [0038.317] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0038.318] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0038.318] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534dc0 [0038.318] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0038.319] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0038.319] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk")) returned 1 [0038.320] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.chk")) returned 0xffffffff [0038.320] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.321] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.321] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0038.321] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0038.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0038.322] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0038.331] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0038.369] ReadFile (in: hFile=0x198, lpBuffer=0x1d46bf4, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bf4*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0038.439] WriteFile (in: hFile=0x194, lpBuffer=0x1d46bf4*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bf4*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0038.455] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0038.486] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0038.490] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.500] CloseHandle (hObject=0x198) returned 1 [0038.500] CloseHandle (hObject=0x194) returned 1 [0038.558] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0038.559] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0038.559] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0038.559] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0038.559] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0038.559] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log")) returned 1 [0038.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb.log")) returned 0xffffffff [0038.560] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.560] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0038.561] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.562] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0038.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0038.562] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0038.571] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0038.609] ReadFile (in: hFile=0x194, lpBuffer=0x1d46cd8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46cd8*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0038.779] WriteFile (in: hFile=0x198, lpBuffer=0x1d46cd8*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46cd8*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0038.794] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0038.810] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0038.814] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0038.821] CloseHandle (hObject=0x194) returned 1 [0038.821] CloseHandle (hObject=0x198) returned 1 [0038.844] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0038.845] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0038.845] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0038.845] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0038.845] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0038.845] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log")) returned 1 [0038.854] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00001.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00001.log")) returned 0xffffffff [0038.854] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0038.855] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0038.855] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0038.855] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0038.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0038.856] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0038.865] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0038.916] ReadFile (in: hFile=0x198, lpBuffer=0x1d46e14, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e14*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0039.012] WriteFile (in: hFile=0x194, lpBuffer=0x1d46e14*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e14*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0039.054] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.079] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.092] CloseHandle (hObject=0x198) returned 1 [0039.092] CloseHandle (hObject=0x194) returned 1 [0039.121] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.121] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0039.122] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534d00 [0039.122] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0039.122] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0039.122] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log")) returned 1 [0039.129] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edb00002.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edb00002.log")) returned 0xffffffff [0039.129] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0039.129] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0039.130] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0039.130] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0039.130] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0039.131] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0039.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.231] ReadFile (in: hFile=0x194, lpBuffer=0x1d46ea8, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ea8*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0039.330] WriteFile (in: hFile=0x198, lpBuffer=0x1d46ea8*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ea8*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0039.345] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.361] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.364] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.371] CloseHandle (hObject=0x194) returned 1 [0039.371] CloseHandle (hObject=0x198) returned 1 [0039.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.394] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0039.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0039.394] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0039.394] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0039.394] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log")) returned 1 [0039.403] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\edbtmp.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\edbtmp.log")) returned 0xffffffff [0039.403] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0039.403] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535180 [0039.403] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0039.403] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0039.403] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534f40 [0039.403] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0039.403] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0039.404] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0039.404] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0039.404] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0039.404] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0039.404] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0039.404] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0039.404] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0039.405] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0039.405] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0039.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534dc0 [0039.405] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0039.405] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0039.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e40 [0039.406] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.406] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.407] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.407] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.408] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0039.408] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0039.408] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0039.408] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534d00 [0039.409] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.409] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.409] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.410] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0039.410] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0039.410] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0039.410] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0039.410] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0039.410] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0039.410] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0039.410] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0039.411] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0039.411] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0039.411] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0039.411] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0039.411] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0039.411] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0039.412] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0039.412] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0039.412] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0039.412] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0039.412] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0039.412] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0039.412] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0039.412] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0039.412] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\SmsRouter\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5353c0 [0039.413] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.413] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0039.413] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0039.413] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0039.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534e40 [0039.413] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.413] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.413] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.413] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.415] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0039.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.415] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.422] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.458] WriteFile (in: hFile=0x190, lpBuffer=0x1d461a4*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d461a4*, lpNumberOfBytesWritten=0x19f3e4*=0x10, lpOverlapped=0x0) returned 1 [0039.458] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.474] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.478] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.484] CloseHandle (hObject=0x188) returned 1 [0039.484] CloseHandle (hObject=0x190) returned 1 [0039.485] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0039.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534dc0 [0039.486] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0039.486] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0039.486] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat")) returned 1 [0039.486] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Administrator.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\administrator.dat")) returned 0xffffffff [0039.486] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.486] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.487] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0039.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.487] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.495] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.529] WriteFile (in: hFile=0x188, lpBuffer=0x1d46384*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46384*, lpNumberOfBytesWritten=0x19f3e4*=0x10, lpOverlapped=0x0) returned 1 [0039.530] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.548] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.551] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.558] CloseHandle (hObject=0x190) returned 1 [0039.558] CloseHandle (hObject=0x188) returned 1 [0039.558] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.559] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0039.559] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535340 [0039.559] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0039.559] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0039.559] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat")) returned 1 [0039.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\CIiHmnxMn6Ps.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\ciihmnxmn6ps.dat")) returned 0xffffffff [0039.560] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.560] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.565] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.565] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4038 [0039.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.565] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.572] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.623] ReadFile (in: hFile=0x188, lpBuffer=0x1d46bd4, nNumberOfBytesToRead=0xc4038, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46bd4*, lpNumberOfBytesRead=0x19f3e4*=0xc4038, lpOverlapped=0x0) returned 1 [0039.651] WriteFile (in: hFile=0x190, lpBuffer=0x1d46bd4*, nNumberOfBytesToWrite=0xc4040, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46bd4*, lpNumberOfBytesWritten=0x19f3e4*=0xc4040, lpOverlapped=0x0) returned 1 [0039.661] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.676] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.679] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.686] CloseHandle (hObject=0x188) returned 1 [0039.686] CloseHandle (hObject=0x190) returned 1 [0039.698] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.698] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0039.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534cc0 [0039.698] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0039.698] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0039.699] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp")) returned 1 [0039.704] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp")) returned 0xffffffff [0039.704] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.704] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.705] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.705] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1518 [0039.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.705] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.712] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.746] ReadFile (in: hFile=0x190, lpBuffer=0x1d46d04, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46d04*, lpNumberOfBytesRead=0x19f3e4*=0x1518, lpOverlapped=0x0) returned 1 [0039.751] WriteFile (in: hFile=0x188, lpBuffer=0x1d46d04*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46d04*, lpNumberOfBytesWritten=0x19f3e4*=0x1520, lpOverlapped=0x0) returned 1 [0039.752] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.766] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.770] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.776] CloseHandle (hObject=0x190) returned 1 [0039.776] CloseHandle (hObject=0x188) returned 1 [0039.777] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.778] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0039.778] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535240 [0039.778] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0039.778] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0039.778] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png")) returned 1 [0039.779] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.png")) returned 0xffffffff [0039.779] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.780] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.780] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.780] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x967 [0039.780] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.780] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.787] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.820] ReadFile (in: hFile=0x188, lpBuffer=0x1d46e3c, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46e3c*, lpNumberOfBytesRead=0x19f3e4*=0x967, lpOverlapped=0x0) returned 1 [0039.821] WriteFile (in: hFile=0x190, lpBuffer=0x1d46e3c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46e3c*, lpNumberOfBytesWritten=0x19f3e4*=0x970, lpOverlapped=0x0) returned 1 [0039.822] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.837] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.841] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.848] CloseHandle (hObject=0x188) returned 1 [0039.848] CloseHandle (hObject=0x190) returned 1 [0039.849] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.850] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0039.850] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535240 [0039.850] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0039.850] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0039.850] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png")) returned 1 [0039.851] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-192.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-192.png")) returned 0xffffffff [0039.851] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.852] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.852] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.852] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19f [0039.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.853] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.859] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.895] ReadFile (in: hFile=0x190, lpBuffer=0x1d46f58, nNumberOfBytesToRead=0x19f, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46f58*, lpNumberOfBytesRead=0x19f3e4*=0x19f, lpOverlapped=0x0) returned 1 [0039.896] WriteFile (in: hFile=0x188, lpBuffer=0x1d46f58*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46f58*, lpNumberOfBytesWritten=0x19f3e4*=0x1a0, lpOverlapped=0x0) returned 1 [0039.896] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0039.912] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0039.917] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0039.926] CloseHandle (hObject=0x190) returned 1 [0039.926] CloseHandle (hObject=0x188) returned 1 [0039.928] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0039.928] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0039.929] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535180 [0039.929] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0039.929] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0039.929] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png")) returned 1 [0039.930] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-32.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-32.png")) returned 0xffffffff [0039.930] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0039.930] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0039.930] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0039.931] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b1 [0039.931] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0039.931] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0039.940] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0039.983] ReadFile (in: hFile=0x188, lpBuffer=0x1d47028, nNumberOfBytesToRead=0x1b1, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d47028*, lpNumberOfBytesRead=0x19f3e4*=0x1b1, lpOverlapped=0x0) returned 1 [0039.984] WriteFile (in: hFile=0x190, lpBuffer=0x1d47028*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d47028*, lpNumberOfBytesWritten=0x19f3e4*=0x1c0, lpOverlapped=0x0) returned 1 [0039.985] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0040.035] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0040.038] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.069] CloseHandle (hObject=0x188) returned 1 [0040.069] CloseHandle (hObject=0x190) returned 1 [0040.069] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0040.070] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0040.070] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535240 [0040.070] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0040.070] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0040.070] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png")) returned 1 [0040.071] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-40.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-40.png")) returned 0xffffffff [0040.071] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.072] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0040.072] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0040.072] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f5 [0040.072] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0040.073] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0040.079] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0040.113] ReadFile (in: hFile=0x190, lpBuffer=0x1d47054, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesRead=0x19f3e4*=0x1f5, lpOverlapped=0x0) returned 1 [0040.114] WriteFile (in: hFile=0x188, lpBuffer=0x1d47054*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesWritten=0x19f3e4*=0x200, lpOverlapped=0x0) returned 1 [0040.114] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0040.129] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0040.133] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.139] CloseHandle (hObject=0x190) returned 1 [0040.139] CloseHandle (hObject=0x188) returned 1 [0040.140] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0040.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0040.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535180 [0040.141] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0040.141] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0040.141] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png")) returned 1 [0040.142] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user-48.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user-48.png")) returned 0xffffffff [0040.142] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.142] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0040.142] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0040.143] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4038 [0040.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0040.143] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0040.150] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0040.184] ReadFile (in: hFile=0x188, lpBuffer=0x1d468ac, nNumberOfBytesToRead=0xc4038, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d468ac*, lpNumberOfBytesRead=0x19f3e4*=0xc4038, lpOverlapped=0x0) returned 1 [0040.220] WriteFile (in: hFile=0x190, lpBuffer=0x1d468ac*, nNumberOfBytesToWrite=0xc4040, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d468ac*, lpNumberOfBytesWritten=0x19f3e4*=0xc4040, lpOverlapped=0x0) returned 1 [0040.230] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0040.247] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0040.250] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.257] CloseHandle (hObject=0x188) returned 1 [0040.257] CloseHandle (hObject=0x190) returned 1 [0040.268] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0040.268] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0040.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534c80 [0040.269] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0040.269] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0040.269] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp")) returned 1 [0040.275] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp")) returned 0xffffffff [0040.275] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.275] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0040.305] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0040.306] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1518 [0040.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0040.307] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0040.314] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0040.351] ReadFile (in: hFile=0x190, lpBuffer=0x1d469ac, nNumberOfBytesToRead=0x1518, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d469ac*, lpNumberOfBytesRead=0x19f3e4*=0x1518, lpOverlapped=0x0) returned 1 [0040.363] WriteFile (in: hFile=0x188, lpBuffer=0x1d469ac*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d469ac*, lpNumberOfBytesWritten=0x19f3e4*=0x1520, lpOverlapped=0x0) returned 1 [0040.364] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0040.380] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0040.384] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0040.391] CloseHandle (hObject=0x190) returned 1 [0040.391] CloseHandle (hObject=0x188) returned 1 [0040.391] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0040.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0040.392] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535080 [0040.392] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0040.392] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0040.392] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png")) returned 1 [0040.393] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.png")) returned 0xffffffff [0040.393] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0040.393] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0040.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535180 [0040.393] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.393] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.393] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\AC658CB4-9126-49BD-B877-31EEDAB3F204\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535040 [0040.393] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.394] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.394] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.395] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.395] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.395] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0040.395] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0040.396] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0040.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WDF\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535340 [0040.396] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0040.396] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0040.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534e40 [0040.396] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.396] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0040.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535080 [0040.396] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.567] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.567] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.568] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.569] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.569] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.570] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.571] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.575] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.576] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.577] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.578] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.578] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.579] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.580] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.580] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.581] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.582] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.622] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.623] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.623] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.624] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.625] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.626] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.626] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.627] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.628] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.628] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.629] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.629] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.630] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.631] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.632] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.633] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.719] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.720] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.720] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.721] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.722] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.722] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.723] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.724] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.725] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.725] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.726] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.727] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.729] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.730] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.731] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.777] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.777] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.778] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.779] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.779] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.780] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.781] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.782] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.782] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.783] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.784] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.785] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.785] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.786] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.787] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.787] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.788] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.796] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.797] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.797] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.798] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.799] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.800] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.800] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.801] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.802] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.802] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.803] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.804] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.804] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.805] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.806] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.807] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.850] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.850] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.851] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.851] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.852] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.854] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.855] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.856] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.856] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.857] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.858] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.858] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.859] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.860] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.860] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.861] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.862] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.864] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.865] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.866] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.866] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.867] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.868] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.869] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0040.869] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0040.869] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0040.870] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0040.870] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0040.907] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.907] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.908] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.908] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.909] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0040.909] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0040.910] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0040.910] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_2015.624.2254.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0040.924] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.924] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.924] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.925] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0040.925] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0040.925] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0040.925] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0040.944] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.944] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.945] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.945] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0040.945] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0040.946] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0040.946] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0040.987] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.987] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.988] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0040.988] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0040.989] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0040.989] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0040.989] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0041.055] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.055] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.055] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.056] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.057] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.057] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0041.057] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.057] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0041.075] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.075] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.075] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.076] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.076] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0041.077] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.077] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_10004.3.193.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0041.118] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.118] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.118] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.119] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.119] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0041.119] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.119] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0041.124] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.124] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.125] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.126] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.126] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0041.127] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.127] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_10004.3.193.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0041.145] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.145] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.145] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.146] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.146] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0041.147] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.147] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0041.150] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.150] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.151] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.151] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.152] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.152] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0041.152] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.152] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_10004.3.193.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0041.210] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.210] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.210] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.211] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.211] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0041.211] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.211] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0041.254] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.254] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.254] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.255] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.256] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.256] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0041.257] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.257] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_10004.3.193.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5353c0 [0041.281] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.281] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.281] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.282] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.282] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0041.282] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.282] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0041.282] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.282] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.283] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.284] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.285] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.285] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0041.285] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.285] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0041.330] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.330] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.330] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.331] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.331] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0041.331] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.332] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0041.343] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.343] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.343] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.344] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.345] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.345] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0041.345] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.345] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2015.622.1108.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0041.348] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.348] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.349] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.349] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.349] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0041.350] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.350] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535340 [0041.380] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.380] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.381] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.381] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.381] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0041.382] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.382] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0041.383] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.383] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.383] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.384] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.384] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0041.384] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.384] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0041.429] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.429] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.429] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.430] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.430] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.430] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0041.431] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.431] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.4218.23751.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0041.448] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.448] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.449] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.449] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.449] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0041.450] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0041.531] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.531] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.532] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.532] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.532] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0041.533] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.533] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0041.539] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.539] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.539] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.540] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.541] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.541] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0041.541] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.541] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0041.561] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.561] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.561] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.562] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.562] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.562] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0041.563] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.563] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Framework.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0041.566] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.566] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.567] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.567] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.568] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.568] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0041.569] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.569] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0041.582] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.583] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.583] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.584] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.584] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.584] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0041.585] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.585] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.NET.Native.Runtime.1.0_1.0.22929.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0041.588] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.589] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.589] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.590] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.590] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.590] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0041.591] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.591] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0041.639] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.639] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.639] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.640] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.640] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.640] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0041.641] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.641] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.4201.10091.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0041.647] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.647] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.647] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.648] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.648] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0041.648] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.648] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_1.10159.0.0_neutral_split.scale-150_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0041.683] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.683] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.684] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.684] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.685] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.685] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0041.686] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.686] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0041.885] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.885] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.885] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.886] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.886] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.886] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0041.887] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.887] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.627.626.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535400 [0041.936] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.936] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.936] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0041.937] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0041.937] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0041.938] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0041.938] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0042.016] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.016] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.016] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.017] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.017] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0042.017] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.017] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0042.078] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.078] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.078] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.079] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.080] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.080] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0042.080] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.080] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22810.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0042.117] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.117] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.117] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.118] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.119] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.119] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0042.119] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.119] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22810.0_x86__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0042.166] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.166] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.166] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.167] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.168] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.168] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0042.168] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.169] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0042.207] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.207] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.208] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.208] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0042.209] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.209] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0042.234] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.234] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.235] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.236] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.236] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0042.236] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.236] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0042.236] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.236] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.237] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.238] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.238] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0042.238] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.238] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0042.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.239] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.239] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.239] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0042.239] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.239] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0042.241] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.241] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.242] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.242] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0042.243] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.243] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0042.302] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.303] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.303] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.304] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.304] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.304] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0042.305] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.618.1921.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0042.340] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.340] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.341] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.341] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.341] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0042.342] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.342] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0042.342] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.342] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.343] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.343] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.343] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0042.343] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.343] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0042.376] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.376] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.377] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.377] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.378] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.378] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0042.378] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.619.10.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0042.427] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.427] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.427] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.428] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.428] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0042.429] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0042.510] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.510] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.510] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.511] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.511] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.511] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0042.512] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.512] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.619.10.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0042.517] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.517] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.518] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.518] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.518] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0042.519] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.519] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.612.1501.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0042.536] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.536] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.536] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.537] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.537] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0042.537] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.537] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0042.572] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.572] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.573] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.573] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.574] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.574] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0042.574] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.574] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0042.584] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.584] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.584] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.585] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.585] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.586] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0042.586] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.586] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6002.42251.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0042.591] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.591] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.591] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.592] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.592] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0042.592] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.592] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0042.596] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.596] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.597] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.597] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0042.597] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_2015.619.213.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0042.657] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.675] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.675] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.676] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.676] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0042.677] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.677] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0042.735] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.735] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.735] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.736] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.736] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.736] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0042.737] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.737] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0042.765] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.765] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.766] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.766] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.767] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.767] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0042.767] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.767] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.620.10.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0042.818] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.818] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.819] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.819] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.819] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0042.820] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.820] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0042.833] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.833] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.833] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.834] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.834] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.834] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0042.835] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.835] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.615.1606.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0042.846] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.846] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.847] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.847] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.847] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0042.848] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.848] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534ec0 [0042.848] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.848] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.849] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.849] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.850] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.850] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0042.850] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.850] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.701.14.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0042.856] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.856] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.857] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.857] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.857] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0042.858] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.858] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.617.130.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0042.866] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.866] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.866] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.867] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.867] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0042.867] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.867] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0042.893] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.893] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.894] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.894] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.895] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.895] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0042.895] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.895] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534ec0 [0042.915] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.915] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.916] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.916] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.916] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0042.917] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.917] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0042.963] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.963] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.964] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.965] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.965] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0042.965] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.965] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.10841.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0042.968] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.968] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0042.969] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0042.969] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0042.970] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0042.970] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_3.6.10841.0_neutral_resources.scale-140_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0043.044] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.044] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.044] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.045] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.046] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.046] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0043.046] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0043.066] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.066] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.067] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.067] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.068] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.068] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0043.068] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.068] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.10811.0_neutral_~_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0043.079] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.079] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.079] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.080] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.080] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0043.081] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_3.6.10811.0_neutral_resources.scale-140_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0043.132] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.132] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.133] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.133] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.134] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.134] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0043.135] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.135] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0043.140] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.140] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.141] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.142] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.142] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0043.142] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.142] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0043.151] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.151] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.152] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.152] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.152] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0043.153] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.153] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\windows.devicesflow_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0043.176] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.176] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.177] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.177] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.177] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0043.178] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.178] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\windows.immersivecontrolpanel_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535400 [0043.178] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.178] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.179] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.179] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.179] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0043.179] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.179] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.MiracastView_6.3.0.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0043.194] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.194] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.195] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.195] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.195] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0043.197] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.197] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PrintDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0043.236] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.237] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.237] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.238] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0043.238] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0043.238] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5353c0 [0043.263] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.263] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.264] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0043.265] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0043.265] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0043.265] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0043.265] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0043.265] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.266] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.266] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.267] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.267] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.268] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.269] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.269] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.270] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.271] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.271] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0043.271] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0043.271] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0043.272] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0043.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0043.272] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.272] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.272] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0043.274] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0043.274] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0043.274] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0043.275] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0043.281] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0043.315] ReadFile (in: hFile=0x190, lpBuffer=0x1d4695c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4695c*, lpNumberOfBytesRead=0x19f17c*=0x4000, lpOverlapped=0x0) returned 1 [0043.332] WriteFile (in: hFile=0x18c, lpBuffer=0x1d4695c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4695c*, lpNumberOfBytesWritten=0x19f17c*=0x4010, lpOverlapped=0x0) returned 1 [0043.333] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0043.348] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0043.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.358] CloseHandle (hObject=0x190) returned 1 [0043.358] CloseHandle (hObject=0x18c) returned 1 [0043.359] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0043.360] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0043.360] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535000 [0043.360] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0043.360] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0043.360] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db")) returned 1 [0043.361] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.0.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.0.db")) returned 0xffffffff [0043.361] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.361] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0043.361] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0043.362] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0043.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0043.362] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0043.436] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0043.590] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46ad8, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46ad8*, lpNumberOfBytesRead=0x19f17c*=0x4000, lpOverlapped=0x0) returned 1 [0043.591] WriteFile (in: hFile=0x190, lpBuffer=0x1d46ad8*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46ad8*, lpNumberOfBytesWritten=0x19f17c*=0x4010, lpOverlapped=0x0) returned 1 [0043.592] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0043.607] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0043.632] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.638] CloseHandle (hObject=0x18c) returned 1 [0043.638] CloseHandle (hObject=0x190) returned 1 [0043.639] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0043.718] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0043.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535300 [0043.719] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0043.719] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0043.719] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db")) returned 0 [0043.719] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db")) returned 0x20 [0043.719] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.719] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0043.720] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0043.720] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0043.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0043.721] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0043.727] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0043.858] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a40, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46a40*, lpNumberOfBytesRead=0x19f17c*=0x4c0, lpOverlapped=0x0) returned 1 [0043.870] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46a40*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46a40*, lpNumberOfBytesWritten=0x19f17c*=0x4d0, lpOverlapped=0x0) returned 1 [0043.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0043.886] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0043.889] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0043.929] CloseHandle (hObject=0x190) returned 1 [0043.929] CloseHandle (hObject=0x18c) returned 1 [0043.930] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0043.931] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0043.931] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0043.931] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0043.931] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0043.931] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db")) returned 1 [0043.932] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{09D18201-A4B9-4F2E-9955-9F6AA81B8F57}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{09d18201-a4b9-4f2e-9955-9f6aa81b8f57}.2.ver0x0000000000000001.db")) returned 0xffffffff [0043.932] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0043.932] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0043.932] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0043.933] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x418 [0043.933] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0043.933] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0043.940] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.068] ReadFile (in: hFile=0x18c, lpBuffer=0x1d469dc, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesRead=0x19f17c*=0x418, lpOverlapped=0x0) returned 1 [0044.068] WriteFile (in: hFile=0x190, lpBuffer=0x1d469dc*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesWritten=0x19f17c*=0x420, lpOverlapped=0x0) returned 1 [0044.069] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.084] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.088] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.096] CloseHandle (hObject=0x18c) returned 1 [0044.097] CloseHandle (hObject=0x190) returned 1 [0044.097] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.098] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.098] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0044.098] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.098] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0044.098] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db")) returned 1 [0044.099] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{0BEC4393-7019-42AE-8AEC-D0B97C8DAE5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{0bec4393-7019-42ae-8aec-d0b97c8dae5c}.2.ver0x0000000000000001.db")) returned 0xffffffff [0044.099] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.099] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.104] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.104] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x418 [0044.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.105] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.111] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.158] ReadFile (in: hFile=0x190, lpBuffer=0x1d469dc, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesRead=0x19f17c*=0x418, lpOverlapped=0x0) returned 1 [0044.167] WriteFile (in: hFile=0x18c, lpBuffer=0x1d469dc*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesWritten=0x19f17c*=0x420, lpOverlapped=0x0) returned 1 [0044.167] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.182] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.186] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.194] CloseHandle (hObject=0x190) returned 1 [0044.195] CloseHandle (hObject=0x18c) returned 1 [0044.195] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.196] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.196] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535040 [0044.196] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.196] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0044.196] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db")) returned 1 [0044.197] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2708910A-9C86-4D84-81B2-1510F1D17941}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2708910a-9c86-4d84-81b2-1510f1d17941}.2.ver0x0000000000000001.db")) returned 0xffffffff [0044.197] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.197] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.197] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.198] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0044.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.198] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.205] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.256] ReadFile (in: hFile=0x18c, lpBuffer=0x1d469dc, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesRead=0x19f17c*=0x4c0, lpOverlapped=0x0) returned 1 [0044.257] WriteFile (in: hFile=0x190, lpBuffer=0x1d469dc*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesWritten=0x19f17c*=0x4d0, lpOverlapped=0x0) returned 1 [0044.258] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.273] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.276] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.307] CloseHandle (hObject=0x18c) returned 1 [0044.308] CloseHandle (hObject=0x190) returned 1 [0044.311] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.312] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535340 [0044.312] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.312] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0044.312] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db")) returned 1 [0044.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2C50E258-F032-4DEF-BB77-9F2739C163A2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2c50e258-f032-4def-bb77-9f2739c163a2}.2.ver0x0000000000000001.db")) returned 0xffffffff [0044.313] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.313] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.314] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.314] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x418 [0044.314] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.314] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.321] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.375] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a3c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46a3c*, lpNumberOfBytesRead=0x19f17c*=0x418, lpOverlapped=0x0) returned 1 [0044.387] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46a3c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46a3c*, lpNumberOfBytesWritten=0x19f17c*=0x420, lpOverlapped=0x0) returned 1 [0044.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.404] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.420] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.427] CloseHandle (hObject=0x190) returned 1 [0044.427] CloseHandle (hObject=0x18c) returned 1 [0044.428] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535300 [0044.429] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.429] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0044.429] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db")) returned 1 [0044.430] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{36E7F215-B041-4578-A3AB-189F3BB27CAE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{36e7f215-b041-4578-a3ab-189f3bb27cae}.2.ver0x0000000000000001.db")) returned 0xffffffff [0044.430] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.431] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.431] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.431] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0044.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.432] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.439] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.496] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46b44, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b44*, lpNumberOfBytesRead=0x19f17c*=0x4c0, lpOverlapped=0x0) returned 1 [0044.511] WriteFile (in: hFile=0x190, lpBuffer=0x1d46b44*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b44*, lpNumberOfBytesWritten=0x19f17c*=0x4d0, lpOverlapped=0x0) returned 1 [0044.512] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.527] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.531] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.537] CloseHandle (hObject=0x18c) returned 1 [0044.538] CloseHandle (hObject=0x190) returned 1 [0044.538] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.539] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.539] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535180 [0044.539] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.539] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0044.539] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db")) returned 1 [0044.540] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4670A2CC-2C32-4CBD-8FC2-9154C01289BE}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4670a2cc-2c32-4cbd-8fc2-9154c01289be}.2.ver0x0000000000000001.db")) returned 0xffffffff [0044.540] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.540] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.541] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42c68 [0044.541] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.541] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.549] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.597] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c9c, nNumberOfBytesToRead=0x42c68, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46c9c*, lpNumberOfBytesRead=0x19f17c*=0x42c68, lpOverlapped=0x0) returned 1 [0044.613] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46c9c*, nNumberOfBytesToWrite=0x42c70, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46c9c*, lpNumberOfBytesWritten=0x19f17c*=0x42c70, lpOverlapped=0x0) returned 1 [0044.616] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.631] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.635] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.648] CloseHandle (hObject=0x190) returned 1 [0044.648] CloseHandle (hObject=0x18c) returned 1 [0044.652] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.653] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.653] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534c80 [0044.653] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.653] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0044.653] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db")) returned 1 [0044.736] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000f.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000f.db")) returned 0xffffffff [0044.736] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.737] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.738] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.744] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42c68 [0044.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.766] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.793] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.838] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46dd8, nNumberOfBytesToRead=0x42c68, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46dd8*, lpNumberOfBytesRead=0x19f17c*=0x42c68, lpOverlapped=0x0) returned 1 [0044.844] WriteFile (in: hFile=0x190, lpBuffer=0x1d46dd8*, nNumberOfBytesToWrite=0x42c70, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46dd8*, lpNumberOfBytesWritten=0x19f17c*=0x42c70, lpOverlapped=0x0) returned 1 [0044.847] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.863] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.874] CloseHandle (hObject=0x18c) returned 1 [0044.874] CloseHandle (hObject=0x190) returned 1 [0044.880] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.880] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.880] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0044.881] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.881] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0044.881] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db")) returned 0 [0044.881] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000013.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000013.db")) returned 0x20 [0044.881] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.881] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.882] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.885] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0044.885] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.885] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.892] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0044.937] ReadFile (in: hFile=0x190, lpBuffer=0x1d46e54, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46e54*, lpNumberOfBytesRead=0x19f17c*=0x4c0, lpOverlapped=0x0) returned 1 [0044.943] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46e54*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46e54*, lpNumberOfBytesWritten=0x19f17c*=0x4d0, lpOverlapped=0x0) returned 1 [0044.944] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0044.959] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0044.962] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0044.970] CloseHandle (hObject=0x190) returned 1 [0044.970] CloseHandle (hObject=0x18c) returned 1 [0044.970] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0044.971] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0044.971] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535000 [0044.971] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0044.971] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0044.971] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db")) returned 1 [0044.972] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6D053B28-9298-4D28-B3A9-39183742D9D2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6d053b28-9298-4d28-b3a9-39183742d9d2}.2.ver0x0000000000000001.db")) returned 0xffffffff [0044.972] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0044.973] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0044.973] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0044.973] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x418 [0044.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0044.973] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0044.980] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0045.075] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46ed0, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46ed0*, lpNumberOfBytesRead=0x19f17c*=0x418, lpOverlapped=0x0) returned 1 [0045.084] WriteFile (in: hFile=0x190, lpBuffer=0x1d46ed0*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46ed0*, lpNumberOfBytesWritten=0x19f17c*=0x420, lpOverlapped=0x0) returned 1 [0045.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0045.104] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0045.108] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.115] CloseHandle (hObject=0x18c) returned 1 [0045.115] CloseHandle (hObject=0x190) returned 1 [0045.116] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0045.117] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0045.117] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x5351c0 [0045.117] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0045.117] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0045.117] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db")) returned 1 [0045.118] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{B26E1282-2273-442B-AF28-CE0DD73F6BC1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{b26e1282-2273-442b-af28-ce0dd73f6bc1}.2.ver0x0000000000000001.db")) returned 0xffffffff [0045.118] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.118] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0045.118] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0045.119] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8af08 [0045.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0045.119] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0045.126] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0045.268] ReadFile (in: hFile=0x190, lpBuffer=0x1d46f4c, nNumberOfBytesToRead=0x8af08, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46f4c*, lpNumberOfBytesRead=0x19f17c*=0x8af08, lpOverlapped=0x0) returned 1 [0045.286] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46f4c*, nNumberOfBytesToWrite=0x8af10, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46f4c*, lpNumberOfBytesWritten=0x19f17c*=0x8af10, lpOverlapped=0x0) returned 1 [0045.293] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0045.308] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0045.312] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.319] CloseHandle (hObject=0x190) returned 1 [0045.319] CloseHandle (hObject=0x18c) returned 1 [0045.327] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0045.336] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0045.336] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0045.336] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0045.336] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0045.336] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")) returned 0 [0045.337] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")) returned 0x20 [0045.337] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.337] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0045.337] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0045.350] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0045.350] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0045.350] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0045.358] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0045.407] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46fc8, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46fc8*, lpNumberOfBytesRead=0x19f17c*=0x4c0, lpOverlapped=0x0) returned 1 [0045.420] WriteFile (in: hFile=0x190, lpBuffer=0x1d46fc8*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46fc8*, lpNumberOfBytesWritten=0x19f17c*=0x4d0, lpOverlapped=0x0) returned 1 [0045.421] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0045.436] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0045.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.461] CloseHandle (hObject=0x18c) returned 1 [0045.461] CloseHandle (hObject=0x190) returned 1 [0045.462] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0045.462] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0045.463] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535180 [0045.463] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0045.463] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0045.463] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db")) returned 1 [0045.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000002.db")) returned 0xffffffff [0045.464] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.465] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0045.467] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0045.468] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0045.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0045.468] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0045.475] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0045.522] ReadFile (in: hFile=0x190, lpBuffer=0x1d47044, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesRead=0x19f17c*=0x4c0, lpOverlapped=0x0) returned 1 [0045.536] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47044*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesWritten=0x19f17c*=0x4d0, lpOverlapped=0x0) returned 1 [0045.537] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0045.553] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0045.557] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.564] CloseHandle (hObject=0x190) returned 1 [0045.564] CloseHandle (hObject=0x18c) returned 1 [0045.564] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0045.565] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0045.565] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0045.565] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0045.565] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0045.565] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db")) returned 1 [0045.566] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{EF380CC1-D6E4-4C55-8F4B-129F0DE8DE3F}.2.ver0x0000000000000003.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ef380cc1-d6e4-4c55-8f4b-129f0de8de3f}.2.ver0x0000000000000003.db")) returned 0xffffffff [0045.566] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0045.566] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0045.566] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0045.566] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535240 [0045.598] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.599] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0045.600] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.600] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Archive\\Apps\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0045.613] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.640] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.641] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.641] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.642] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.642] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.643] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.643] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.644] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.644] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.645] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.645] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.646] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.646] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.647] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.647] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.648] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.649] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.649] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.650] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.650] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.651] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.651] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.652] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.657] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.657] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.658] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.659] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.659] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.660] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.660] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.661] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.661] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.662] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.662] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.663] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.663] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.664] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.665] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.665] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.666] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.666] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.667] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.667] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.668] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.668] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.669] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.669] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.670] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.671] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.672] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.672] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.673] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.673] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.674] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.674] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.675] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0045.675] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0045.676] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0045.676] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0045.676] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\GenuineTicket\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5353c0 [0045.676] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.676] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0045.676] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0045.676] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Import\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0045.676] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.676] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0045.676] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0045.676] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.676] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Install\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535380 [0045.677] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.677] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.677] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Install\\Apps\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535400 [0045.678] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.678] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0045.678] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0045.678] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.678] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\Install\\Migration\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0045.681] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.681] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0045.681] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0045.681] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0045.681] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0045.681] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.681] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0045.681] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0045.683] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69cea [0045.683] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0045.684] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0045.690] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0045.737] ReadFile (in: hFile=0x18c, lpBuffer=0x1d469e4, nNumberOfBytesToRead=0x69cea, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesRead=0x19f17c*=0x69cea, lpOverlapped=0x0) returned 1 [0045.774] WriteFile (in: hFile=0x190, lpBuffer=0x1d469e4*, nNumberOfBytesToWrite=0x69cf0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesWritten=0x19f17c*=0x69cf0, lpOverlapped=0x0) returned 1 [0045.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0045.794] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0045.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.804] CloseHandle (hObject=0x18c) returned 1 [0045.804] CloseHandle (hObject=0x190) returned 1 [0045.810] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0045.811] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0045.811] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535180 [0045.811] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0045.811] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0045.811] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat")) returned 1 [0045.815] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\ClipSVC\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\clipsvc\\tokens.dat")) returned 0xffffffff [0045.816] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0045.816] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0045.816] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0045.816] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0045.817] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.817] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.817] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0045.819] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0045.819] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaeb98 [0045.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0045.820] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0045.826] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0045.872] ReadFile (in: hFile=0x190, lpBuffer=0x1d46998, nNumberOfBytesToRead=0xaeb98, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46998*, lpNumberOfBytesRead=0x19f17c*=0xaeb98, lpOverlapped=0x0) returned 1 [0045.914] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46998*, nNumberOfBytesToWrite=0xaeba0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46998*, lpNumberOfBytesWritten=0x19f17c*=0xaeba0, lpOverlapped=0x0) returned 1 [0045.923] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0045.966] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0045.970] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.976] CloseHandle (hObject=0x190) returned 1 [0045.976] CloseHandle (hObject=0x18c) returned 1 [0045.987] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0045.987] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0045.987] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0045.988] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0045.988] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0045.988] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx")) returned 1 [0045.993] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrc.idx" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatacache\\dmrc.idx")) returned 0xffffffff [0045.993] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0045.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrccache\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0045.993] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.993] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0045.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataCache\\dmrccache\\downloads\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0045.993] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0045.993] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0045.993] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0045.993] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0045.993] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0045.993] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0045.993] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0045.993] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0045.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535080 [0046.001] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.001] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.001] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0046.002] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.002] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.002] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.003] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.003] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0046.003] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.003] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0046.003] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.003] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceSoftwareUpdates\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534c80 [0046.003] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.003] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.003] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0046.003] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.003] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5353c0 [0046.003] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.004] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.004] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0046.004] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.004] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.004] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0046.004] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.004] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0046.004] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.004] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0046.006] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.006] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.006] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0046.006] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.006] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0046.006] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.006] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.006] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0046.006] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.006] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.006] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.006] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.009] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0046.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.009] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.072] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.119] WriteFile (in: hFile=0x198, lpBuffer=0x1d46e48*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e48*, lpNumberOfBytesWritten=0x19ef14*=0x10, lpOverlapped=0x0) returned 1 [0046.120] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0046.135] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0046.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.146] CloseHandle (hObject=0x190) returned 1 [0046.146] CloseHandle (hObject=0x198) returned 1 [0046.146] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0046.147] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0046.147] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535080 [0046.147] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0046.147] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0046.147] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat")) returned 1 [0046.147] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\LfSvc\\Geofence\\GeofenceApplicationID.dat" (normalized: "c:\\users\\all users\\microsoft\\windows\\lfsvc\\geofence\\geofenceapplicationid.dat")) returned 0xffffffff [0046.147] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.148] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0046.148] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.148] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0046.148] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.148] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Parental Controls\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534cc0 [0046.148] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.148] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.148] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Parental Controls\\settings\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0046.148] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.148] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.148] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0046.148] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.148] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0046.148] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.148] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0046.158] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.158] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.158] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.159] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.159] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.159] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.160] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.160] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.161] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0046.161] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.162] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x342d [0046.162] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.162] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.169] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.215] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46f3c, nNumberOfBytesToRead=0x342d, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46f3c*, lpNumberOfBytesRead=0x19f17c*=0x342d, lpOverlapped=0x0) returned 1 [0046.220] WriteFile (in: hFile=0x198, lpBuffer=0x1d46f3c*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46f3c*, lpNumberOfBytesWritten=0x19f17c*=0x3430, lpOverlapped=0x0) returned 1 [0046.221] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0046.255] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0046.259] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.265] CloseHandle (hObject=0x18c) returned 1 [0046.265] CloseHandle (hObject=0x198) returned 1 [0046.266] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0046.267] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0046.267] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534ec0 [0046.267] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0046.267] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0046.267] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) returned 1 [0046.268] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\users\\all users\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) returned 0xffffffff [0046.268] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.268] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0046.268] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0046.269] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.269] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.269] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0046.269] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\SleepStudy\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534d00 [0046.273] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.273] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.273] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0046.273] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.273] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0046.274] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.274] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0046.275] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.275] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.275] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0046.275] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0046.275] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.275] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.275] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0046.275] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0046.275] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.276] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0046.276] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0046.276] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0046.276] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0046.276] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0046.276] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535200 [0046.276] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.276] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.276] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.276] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0046.277] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0046.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.278] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.284] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.331] ReadFile (in: hFile=0x198, lpBuffer=0x1d46e90, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46e90*, lpNumberOfBytesRead=0x19f17c*=0xae, lpOverlapped=0x0) returned 1 [0046.331] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46e90*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46e90*, lpNumberOfBytesWritten=0x19f17c*=0xb0, lpOverlapped=0x0) returned 1 [0046.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0046.347] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0046.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.357] CloseHandle (hObject=0x198) returned 1 [0046.357] CloseHandle (hObject=0x18c) returned 1 [0046.484] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0046.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0046.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535180 [0046.485] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0046.485] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0046.485] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0046.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0046.489] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0046.489] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0046.489] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.489] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.490] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.490] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.491] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x974 [0046.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.492] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.498] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.545] ReadFile (in: hFile=0x198, lpBuffer=0x1d46bc0, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46bc0*, lpNumberOfBytesRead=0x19ef14*=0x974, lpOverlapped=0x0) returned 1 [0046.552] WriteFile (in: hFile=0x190, lpBuffer=0x1d46bc0*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46bc0*, lpNumberOfBytesWritten=0x19ef14*=0x980, lpOverlapped=0x0) returned 1 [0046.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0046.572] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0046.576] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.582] CloseHandle (hObject=0x198) returned 1 [0046.583] CloseHandle (hObject=0x190) returned 1 [0046.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0046.610] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0046.610] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0046.610] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0046.610] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0046.610] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 1 [0046.625] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 0xffffffff [0046.625] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.625] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.627] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0046.675] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x974 [0046.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.675] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.681] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.747] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b28, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b28*, lpNumberOfBytesRead=0x19ef14*=0x974, lpOverlapped=0x0) returned 1 [0046.760] WriteFile (in: hFile=0x198, lpBuffer=0x1d46b28*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b28*, lpNumberOfBytesWritten=0x19ef14*=0x980, lpOverlapped=0x0) returned 1 [0046.761] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0046.775] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0046.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.786] CloseHandle (hObject=0x190) returned 1 [0046.786] CloseHandle (hObject=0x198) returned 1 [0046.787] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0046.788] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0046.788] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535400 [0046.788] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0046.788] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0046.788] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk")) returned 1 [0046.789] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access.lnk")) returned 0xffffffff [0046.789] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0046.789] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535340 [0046.789] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0046.789] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0046.789] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.790] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0046.790] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x172 [0046.790] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.790] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.799] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.848] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c5c, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c5c*, lpNumberOfBytesRead=0x19ecac*=0x172, lpOverlapped=0x0) returned 1 [0046.849] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c5c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c5c*, lpNumberOfBytesWritten=0x19ecac*=0x180, lpOverlapped=0x0) returned 1 [0046.850] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0046.865] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0046.868] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0046.875] CloseHandle (hObject=0x190) returned 1 [0046.875] CloseHandle (hObject=0x194) returned 1 [0046.882] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0046.918] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0046.918] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0046.919] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0046.919] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0046.919] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 1 [0046.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini")) returned 0xffffffff [0046.922] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0046.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0046.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0046.936] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4dc [0046.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0046.937] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0046.943] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0046.991] ReadFile (in: hFile=0x194, lpBuffer=0x1d46d60, nNumberOfBytesToRead=0x4dc, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d60*, lpNumberOfBytesRead=0x19ecac*=0x4dc, lpOverlapped=0x0) returned 1 [0047.353] WriteFile (in: hFile=0x190, lpBuffer=0x1d46d60*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d60*, lpNumberOfBytesWritten=0x19ecac*=0x4e0, lpOverlapped=0x0) returned 1 [0047.362] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0047.377] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0047.380] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.387] CloseHandle (hObject=0x194) returned 1 [0047.387] CloseHandle (hObject=0x190) returned 1 [0047.388] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0047.389] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0047.389] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0047.389] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0047.389] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0047.389] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk")) returned 1 [0047.389] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk")) returned 0xffffffff [0047.389] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0047.389] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0047.389] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0047.390] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0047.390] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0047.390] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0047.390] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.390] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0047.391] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c0 [0047.391] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0047.391] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0047.398] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0047.458] ReadFile (in: hFile=0x190, lpBuffer=0x1d46cb4, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46cb4*, lpNumberOfBytesRead=0x19ecac*=0x5c0, lpOverlapped=0x0) returned 1 [0047.459] WriteFile (in: hFile=0x194, lpBuffer=0x1d46cb4*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46cb4*, lpNumberOfBytesWritten=0x19ecac*=0x5d0, lpOverlapped=0x0) returned 1 [0047.460] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0047.475] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0047.479] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.486] CloseHandle (hObject=0x190) returned 1 [0047.486] CloseHandle (hObject=0x194) returned 1 [0047.492] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0047.535] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0047.535] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0047.535] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0047.535] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0047.535] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0047.563] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0047.565] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0047.570] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0047.573] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.644] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49e [0047.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0047.644] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0047.651] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0047.703] ReadFile (in: hFile=0x194, lpBuffer=0x1d469e4, nNumberOfBytesToRead=0x49e, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesRead=0x19ecac*=0x49e, lpOverlapped=0x0) returned 1 [0047.711] WriteFile (in: hFile=0x190, lpBuffer=0x1d469e4*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesWritten=0x19ecac*=0x4a0, lpOverlapped=0x0) returned 1 [0047.712] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0047.727] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0047.731] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.743] CloseHandle (hObject=0x194) returned 1 [0047.743] CloseHandle (hObject=0x190) returned 1 [0047.747] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0047.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0047.754] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0047.754] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0047.754] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0047.755] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 1 [0047.759] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0xffffffff [0047.759] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0047.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0047.804] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45a [0047.804] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0047.804] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0047.811] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0047.862] ReadFile (in: hFile=0x190, lpBuffer=0x1d469b4, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469b4*, lpNumberOfBytesRead=0x19ecac*=0x45a, lpOverlapped=0x0) returned 1 [0047.863] WriteFile (in: hFile=0x194, lpBuffer=0x1d469b4*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469b4*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0047.864] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0047.879] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0047.883] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.889] CloseHandle (hObject=0x190) returned 1 [0047.889] CloseHandle (hObject=0x194) returned 1 [0047.896] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0047.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0047.896] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0047.897] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0047.897] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0047.897] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 1 [0047.897] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0xffffffff [0047.897] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0047.898] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0047.898] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.898] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bf [0047.898] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0047.898] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0047.905] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0047.970] ReadFile (in: hFile=0x194, lpBuffer=0x1d46a38, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a38*, lpNumberOfBytesRead=0x19ecac*=0x4bf, lpOverlapped=0x0) returned 1 [0047.971] WriteFile (in: hFile=0x190, lpBuffer=0x1d46a38*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a38*, lpNumberOfBytesWritten=0x19ecac*=0x4c0, lpOverlapped=0x0) returned 1 [0047.971] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0047.986] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0047.990] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0047.996] CloseHandle (hObject=0x194) returned 1 [0047.996] CloseHandle (hObject=0x190) returned 1 [0047.997] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0047.998] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0047.998] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535400 [0047.998] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0047.998] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0047.998] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 1 [0047.998] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0xffffffff [0047.998] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0047.999] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0047.999] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0048.004] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46e [0048.004] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0048.005] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0048.011] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0048.263] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a6c, nNumberOfBytesToRead=0x46e, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a6c*, lpNumberOfBytesRead=0x19ecac*=0x46e, lpOverlapped=0x0) returned 1 [0048.264] WriteFile (in: hFile=0x194, lpBuffer=0x1d46a6c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a6c*, lpNumberOfBytesWritten=0x19ecac*=0x470, lpOverlapped=0x0) returned 1 [0048.266] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0048.284] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0048.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.294] CloseHandle (hObject=0x190) returned 1 [0048.294] CloseHandle (hObject=0x194) returned 1 [0048.314] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0048.367] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0048.377] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0048.377] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0048.377] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0048.377] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 1 [0048.399] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0xffffffff [0048.399] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0048.399] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0048.429] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.493] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x448 [0048.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0048.494] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0048.503] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0048.570] ReadFile (in: hFile=0x194, lpBuffer=0x1d46a6c, nNumberOfBytesToRead=0x448, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a6c*, lpNumberOfBytesRead=0x19ecac*=0x448, lpOverlapped=0x0) returned 1 [0048.571] WriteFile (in: hFile=0x190, lpBuffer=0x1d46a6c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a6c*, lpNumberOfBytesWritten=0x19ecac*=0x450, lpOverlapped=0x0) returned 1 [0048.572] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0048.602] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0048.605] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.614] CloseHandle (hObject=0x194) returned 1 [0048.614] CloseHandle (hObject=0x190) returned 1 [0048.614] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0048.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0048.615] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0048.615] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0048.615] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0048.615] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk")) returned 1 [0048.616] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk")) returned 0xffffffff [0048.616] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0048.616] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0048.616] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0048.617] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a9 [0048.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0048.617] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0048.623] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0048.669] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a6c, nNumberOfBytesToRead=0x4a9, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a6c*, lpNumberOfBytesRead=0x19ecac*=0x4a9, lpOverlapped=0x0) returned 1 [0048.670] WriteFile (in: hFile=0x194, lpBuffer=0x1d46a6c*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a6c*, lpNumberOfBytesWritten=0x19ecac*=0x4b0, lpOverlapped=0x0) returned 1 [0048.670] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0048.685] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0048.689] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0048.703] CloseHandle (hObject=0x190) returned 1 [0048.703] CloseHandle (hObject=0x194) returned 1 [0048.913] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0049.083] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0049.083] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0049.083] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0049.083] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0049.083] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 1 [0049.102] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 0xffffffff [0049.102] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0049.102] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0049.102] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0049.102] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0049.103] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.103] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0049.116] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45a [0049.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0049.116] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0049.123] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0049.194] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c78, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d46c78*, lpNumberOfBytesRead=0x19ea44*=0x45a, lpOverlapped=0x0) returned 1 [0049.196] WriteFile (in: hFile=0x19c, lpBuffer=0x1d46c78*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d46c78*, lpNumberOfBytesWritten=0x19ea44*=0x460, lpOverlapped=0x0) returned 1 [0049.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0049.225] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0049.229] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.235] CloseHandle (hObject=0x190) returned 1 [0049.236] CloseHandle (hObject=0x19c) returned 1 [0049.258] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0049.280] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0049.280] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535180 [0049.281] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0049.281] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0049.281] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 1 [0049.334] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0xffffffff [0049.334] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0049.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0049.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.493] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55 [0049.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0049.494] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0049.500] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0049.558] ReadFile (in: hFile=0x19c, lpBuffer=0x1d46b54, nNumberOfBytesToRead=0x55, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d46b54*, lpNumberOfBytesRead=0x19ea44*=0x55, lpOverlapped=0x0) returned 1 [0049.558] WriteFile (in: hFile=0x190, lpBuffer=0x1d46b54*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d46b54*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0049.559] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0049.584] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0049.588] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.596] CloseHandle (hObject=0x19c) returned 1 [0049.596] CloseHandle (hObject=0x190) returned 1 [0049.645] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0049.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0049.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0049.697] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0049.697] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0049.697] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0049.714] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0049.714] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0049.714] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0049.721] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0049.721] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0049.721] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0049.721] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0049.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0049.726] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba [0049.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0049.727] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0049.735] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0049.783] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b68, nNumberOfBytesToRead=0xba, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d46b68*, lpNumberOfBytesRead=0x19ea44*=0xba, lpOverlapped=0x0) returned 1 [0049.783] WriteFile (in: hFile=0x19c, lpBuffer=0x1d46b68*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d46b68*, lpNumberOfBytesWritten=0x19ea44*=0xc0, lpOverlapped=0x0) returned 1 [0049.784] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0049.803] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0049.807] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0049.814] CloseHandle (hObject=0x190) returned 1 [0049.814] CloseHandle (hObject=0x19c) returned 1 [0049.818] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0049.868] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0049.868] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0049.868] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0049.868] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0049.868] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 1 [0049.876] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 0xffffffff [0049.876] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0049.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0049.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0049.921] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x484 [0049.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0049.921] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0049.928] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0049.970] ReadFile (in: hFile=0x19c, lpBuffer=0x1d469dc, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesRead=0x19ea44*=0x484, lpOverlapped=0x0) returned 1 [0049.991] WriteFile (in: hFile=0x190, lpBuffer=0x1d469dc*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d469dc*, lpNumberOfBytesWritten=0x19ea44*=0x490, lpOverlapped=0x0) returned 1 [0049.992] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.067] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.070] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.078] CloseHandle (hObject=0x19c) returned 1 [0050.078] CloseHandle (hObject=0x190) returned 1 [0050.087] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.091] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.091] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0050.091] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0050.091] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0050.091] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 1 [0050.106] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 0xffffffff [0050.106] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0050.106] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0050.115] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.115] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0050.116] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.141] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x448 [0050.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.141] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.148] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0050.191] ReadFile (in: hFile=0x194, lpBuffer=0x1d469ec, nNumberOfBytesToRead=0x448, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesRead=0x19ecac*=0x448, lpOverlapped=0x0) returned 1 [0050.192] WriteFile (in: hFile=0x190, lpBuffer=0x1d469ec*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesWritten=0x19ecac*=0x450, lpOverlapped=0x0) returned 1 [0050.193] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.208] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.212] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.218] CloseHandle (hObject=0x194) returned 1 [0050.218] CloseHandle (hObject=0x190) returned 1 [0050.219] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.220] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.220] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0050.220] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0050.220] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0050.220] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk")) returned 1 [0050.220] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk")) returned 0xffffffff [0050.221] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.221] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.221] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0050.221] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x543 [0050.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.222] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.229] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0050.270] ReadFile (in: hFile=0x190, lpBuffer=0x1d469ec, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesRead=0x19ecac*=0x543, lpOverlapped=0x0) returned 1 [0050.272] WriteFile (in: hFile=0x194, lpBuffer=0x1d469ec*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesWritten=0x19ecac*=0x550, lpOverlapped=0x0) returned 1 [0050.282] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.297] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.300] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.308] CloseHandle (hObject=0x190) returned 1 [0050.308] CloseHandle (hObject=0x194) returned 1 [0050.314] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.316] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0050.317] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0050.317] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0050.317] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk")) returned 1 [0050.318] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk")) returned 0xffffffff [0050.318] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.318] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0050.319] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.321] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x482 [0050.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.322] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.328] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0050.371] ReadFile (in: hFile=0x194, lpBuffer=0x1d469b4, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469b4*, lpNumberOfBytesRead=0x19ecac*=0x482, lpOverlapped=0x0) returned 1 [0050.373] WriteFile (in: hFile=0x190, lpBuffer=0x1d469b4*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469b4*, lpNumberOfBytesWritten=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0050.374] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.389] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.401] CloseHandle (hObject=0x194) returned 1 [0050.401] CloseHandle (hObject=0x190) returned 1 [0050.403] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0050.405] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0050.405] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0050.405] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 1 [0050.406] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0xffffffff [0050.406] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.406] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0050.416] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462 [0050.416] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.416] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.423] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0050.467] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b8c, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46b8c*, lpNumberOfBytesRead=0x19ecac*=0x462, lpOverlapped=0x0) returned 1 [0050.468] WriteFile (in: hFile=0x194, lpBuffer=0x1d46b8c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46b8c*, lpNumberOfBytesWritten=0x19ecac*=0x470, lpOverlapped=0x0) returned 1 [0050.469] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.485] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.490] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.497] CloseHandle (hObject=0x190) returned 1 [0050.497] CloseHandle (hObject=0x194) returned 1 [0050.499] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0050.501] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0050.501] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0050.501] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk")) returned 1 [0050.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk")) returned 0xffffffff [0050.502] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0050.502] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0050.503] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0050.503] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.503] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0050.506] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x999 [0050.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.506] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.513] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0050.555] ReadFile (in: hFile=0x198, lpBuffer=0x1d46c70, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c70*, lpNumberOfBytesRead=0x19ef14*=0x999, lpOverlapped=0x0) returned 1 [0050.567] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c70*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c70*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0050.568] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.584] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.589] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.595] CloseHandle (hObject=0x198) returned 1 [0050.595] CloseHandle (hObject=0x194) returned 1 [0050.597] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.598] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535040 [0050.598] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0050.598] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0050.598] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk")) returned 1 [0050.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk")) returned 0xffffffff [0050.600] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0050.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0050.600] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.600] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.600] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.601] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.611] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45c [0050.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.611] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.719] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0050.788] ReadFile (in: hFile=0x198, lpBuffer=0x1d46bd8, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bd8*, lpNumberOfBytesRead=0x19ecac*=0x45c, lpOverlapped=0x0) returned 1 [0050.791] WriteFile (in: hFile=0x190, lpBuffer=0x1d46bd8*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bd8*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0050.792] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0050.819] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0050.823] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0050.829] CloseHandle (hObject=0x198) returned 1 [0050.829] CloseHandle (hObject=0x190) returned 1 [0050.830] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0050.831] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0050.831] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535340 [0050.831] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0050.831] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0050.831] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 1 [0050.832] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0xffffffff [0050.832] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0050.832] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0050.832] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0050.833] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48c [0050.833] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0050.833] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0050.842] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.283] ReadFile (in: hFile=0x190, lpBuffer=0x1d469e4, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesRead=0x19ecac*=0x48c, lpOverlapped=0x0) returned 1 [0051.296] WriteFile (in: hFile=0x198, lpBuffer=0x1d469e4*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesWritten=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0051.297] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.322] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.326] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.333] CloseHandle (hObject=0x190) returned 1 [0051.333] CloseHandle (hObject=0x198) returned 1 [0051.334] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.334] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.334] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0051.335] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.335] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0051.335] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 1 [0051.335] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0xffffffff [0051.335] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.337] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa26 [0051.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.337] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.344] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.386] ReadFile (in: hFile=0x198, lpBuffer=0x1d469f4, nNumberOfBytesToRead=0xa26, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469f4*, lpNumberOfBytesRead=0x19ecac*=0xa26, lpOverlapped=0x0) returned 1 [0051.387] WriteFile (in: hFile=0x190, lpBuffer=0x1d469f4*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469f4*, lpNumberOfBytesWritten=0x19ecac*=0xa30, lpOverlapped=0x0) returned 1 [0051.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.404] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.414] CloseHandle (hObject=0x198) returned 1 [0051.415] CloseHandle (hObject=0x190) returned 1 [0051.415] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.416] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.416] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0051.416] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.416] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0051.416] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0051.417] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0051.418] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.418] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.418] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.418] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x486 [0051.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.419] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.426] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.469] ReadFile (in: hFile=0x190, lpBuffer=0x1d46af8, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46af8*, lpNumberOfBytesRead=0x19ecac*=0x486, lpOverlapped=0x0) returned 1 [0051.470] WriteFile (in: hFile=0x198, lpBuffer=0x1d46af8*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46af8*, lpNumberOfBytesWritten=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0051.471] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.486] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.490] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.498] CloseHandle (hObject=0x190) returned 1 [0051.498] CloseHandle (hObject=0x198) returned 1 [0051.499] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.500] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0051.500] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.500] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0051.500] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk")) returned 1 [0051.500] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk")) returned 0xffffffff [0051.501] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.501] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.501] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.501] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45c [0051.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.502] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.509] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.551] ReadFile (in: hFile=0x198, lpBuffer=0x1d46aec, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46aec*, lpNumberOfBytesRead=0x19ecac*=0x45c, lpOverlapped=0x0) returned 1 [0051.552] WriteFile (in: hFile=0x190, lpBuffer=0x1d46aec*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46aec*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0051.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.568] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.572] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.579] CloseHandle (hObject=0x198) returned 1 [0051.579] CloseHandle (hObject=0x190) returned 1 [0051.580] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.580] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.580] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0051.580] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.580] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0051.581] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk")) returned 1 [0051.581] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk")) returned 0xffffffff [0051.581] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.581] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.581] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.582] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x490 [0051.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.582] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.590] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.631] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b14, nNumberOfBytesToRead=0x490, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46b14*, lpNumberOfBytesRead=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0051.633] WriteFile (in: hFile=0x198, lpBuffer=0x1d46b14*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46b14*, lpNumberOfBytesWritten=0x19ecac*=0x4a0, lpOverlapped=0x0) returned 1 [0051.634] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.649] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.653] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.659] CloseHandle (hObject=0x190) returned 1 [0051.660] CloseHandle (hObject=0x198) returned 1 [0051.660] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.661] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.661] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0051.661] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.661] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0051.661] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 1 [0051.661] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0xffffffff [0051.662] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.662] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.663] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.664] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x478 [0051.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.664] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.671] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.713] ReadFile (in: hFile=0x198, lpBuffer=0x1d4699c, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4699c*, lpNumberOfBytesRead=0x19ecac*=0x478, lpOverlapped=0x0) returned 1 [0051.714] WriteFile (in: hFile=0x190, lpBuffer=0x1d4699c*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4699c*, lpNumberOfBytesWritten=0x19ecac*=0x480, lpOverlapped=0x0) returned 1 [0051.715] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.730] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.740] CloseHandle (hObject=0x198) returned 1 [0051.740] CloseHandle (hObject=0x190) returned 1 [0051.741] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0051.741] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.742] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0051.742] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 1 [0051.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0xffffffff [0051.742] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.743] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.743] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.744] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x474 [0051.744] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.744] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.751] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.793] ReadFile (in: hFile=0x190, lpBuffer=0x1d469ec, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesRead=0x19ecac*=0x474, lpOverlapped=0x0) returned 1 [0051.795] WriteFile (in: hFile=0x198, lpBuffer=0x1d469ec*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesWritten=0x19ecac*=0x480, lpOverlapped=0x0) returned 1 [0051.795] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.810] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.814] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.821] CloseHandle (hObject=0x190) returned 1 [0051.821] CloseHandle (hObject=0x198) returned 1 [0051.822] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.823] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.823] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0051.823] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.823] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0051.823] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 1 [0051.824] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0xffffffff [0051.824] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.824] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.824] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.825] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x474 [0051.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.825] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.832] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.876] ReadFile (in: hFile=0x198, lpBuffer=0x1d46a70, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a70*, lpNumberOfBytesRead=0x19ecac*=0x474, lpOverlapped=0x0) returned 1 [0051.879] WriteFile (in: hFile=0x190, lpBuffer=0x1d46a70*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a70*, lpNumberOfBytesWritten=0x19ecac*=0x480, lpOverlapped=0x0) returned 1 [0051.880] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.895] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.899] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.906] CloseHandle (hObject=0x198) returned 1 [0051.906] CloseHandle (hObject=0x190) returned 1 [0051.907] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.907] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.907] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0051.908] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.908] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0051.908] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk")) returned 1 [0051.908] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk")) returned 0xffffffff [0051.908] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.909] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.909] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.909] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x474 [0051.909] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.909] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0051.918] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0051.961] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a70, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a70*, lpNumberOfBytesRead=0x19ecac*=0x474, lpOverlapped=0x0) returned 1 [0051.962] WriteFile (in: hFile=0x198, lpBuffer=0x1d46a70*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a70*, lpNumberOfBytesWritten=0x19ecac*=0x480, lpOverlapped=0x0) returned 1 [0051.963] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0051.978] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0051.982] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0051.989] CloseHandle (hObject=0x190) returned 1 [0051.989] CloseHandle (hObject=0x198) returned 1 [0051.990] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0051.990] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0051.990] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0051.991] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0051.991] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0051.991] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk")) returned 1 [0051.991] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk")) returned 0xffffffff [0051.991] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0051.991] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0051.992] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0051.993] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x450 [0051.993] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0051.993] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.000] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.137] ReadFile (in: hFile=0x198, lpBuffer=0x1d46ab0, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ab0*, lpNumberOfBytesRead=0x19ecac*=0x450, lpOverlapped=0x0) returned 1 [0052.139] WriteFile (in: hFile=0x190, lpBuffer=0x1d46ab0*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ab0*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0052.139] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.155] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.158] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.165] CloseHandle (hObject=0x198) returned 1 [0052.165] CloseHandle (hObject=0x190) returned 1 [0052.166] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.167] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.167] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0052.167] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.167] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0052.167] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 1 [0052.167] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0xffffffff [0052.167] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.168] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.168] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.168] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45e [0052.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.169] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.175] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.219] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c9c, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c9c*, lpNumberOfBytesRead=0x19ecac*=0x45e, lpOverlapped=0x0) returned 1 [0052.221] WriteFile (in: hFile=0x198, lpBuffer=0x1d46c9c*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c9c*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0052.221] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.237] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.241] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.248] CloseHandle (hObject=0x190) returned 1 [0052.248] CloseHandle (hObject=0x198) returned 1 [0052.249] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.250] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.250] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0052.250] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.250] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0052.250] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 1 [0052.250] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0xffffffff [0052.250] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.251] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.251] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.251] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x454 [0052.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.252] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.259] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.404] ReadFile (in: hFile=0x198, lpBuffer=0x1d46da8, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46da8*, lpNumberOfBytesRead=0x19ecac*=0x454, lpOverlapped=0x0) returned 1 [0052.405] WriteFile (in: hFile=0x190, lpBuffer=0x1d46da8*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46da8*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0052.406] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.422] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.432] CloseHandle (hObject=0x198) returned 1 [0052.432] CloseHandle (hObject=0x190) returned 1 [0052.433] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.434] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.434] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0052.434] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.434] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0052.434] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk")) returned 1 [0052.435] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk")) returned 0xffffffff [0052.435] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.435] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.435] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.436] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462 [0052.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.436] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.443] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.488] ReadFile (in: hFile=0x190, lpBuffer=0x1d46ed4, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ed4*, lpNumberOfBytesRead=0x19ecac*=0x462, lpOverlapped=0x0) returned 1 [0052.490] WriteFile (in: hFile=0x198, lpBuffer=0x1d46ed4*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ed4*, lpNumberOfBytesWritten=0x19ecac*=0x470, lpOverlapped=0x0) returned 1 [0052.491] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.506] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.517] CloseHandle (hObject=0x190) returned 1 [0052.517] CloseHandle (hObject=0x198) returned 1 [0052.517] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.518] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.518] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0052.518] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.518] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0052.518] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 1 [0052.519] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0xffffffff [0052.519] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.519] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.520] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.521] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x486 [0052.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.521] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.529] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.576] ReadFile (in: hFile=0x198, lpBuffer=0x1d46e3c, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e3c*, lpNumberOfBytesRead=0x19ecac*=0x486, lpOverlapped=0x0) returned 1 [0052.577] WriteFile (in: hFile=0x190, lpBuffer=0x1d46e3c*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e3c*, lpNumberOfBytesWritten=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0052.578] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.593] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.597] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.604] CloseHandle (hObject=0x198) returned 1 [0052.604] CloseHandle (hObject=0x190) returned 1 [0052.605] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0052.606] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.606] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0052.606] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 1 [0052.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0xffffffff [0052.607] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.608] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45c [0052.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.609] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.615] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.682] ReadFile (in: hFile=0x190, lpBuffer=0x1d469ec, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesRead=0x19ecac*=0x45c, lpOverlapped=0x0) returned 1 [0052.683] WriteFile (in: hFile=0x198, lpBuffer=0x1d469ec*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469ec*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0052.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.699] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.703] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.711] CloseHandle (hObject=0x190) returned 1 [0052.711] CloseHandle (hObject=0x198) returned 1 [0052.713] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.717] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535400 [0052.718] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.718] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0052.718] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 1 [0052.721] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0xffffffff [0052.721] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.725] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45a [0052.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.725] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.732] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.783] ReadFile (in: hFile=0x198, lpBuffer=0x1d46a58, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a58*, lpNumberOfBytesRead=0x19ecac*=0x45a, lpOverlapped=0x0) returned 1 [0052.784] WriteFile (in: hFile=0x190, lpBuffer=0x1d46a58*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a58*, lpNumberOfBytesWritten=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0052.785] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.799] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.803] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.810] CloseHandle (hObject=0x198) returned 1 [0052.810] CloseHandle (hObject=0x190) returned 1 [0052.812] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.814] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.814] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0052.814] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.814] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0052.814] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk")) returned 1 [0052.833] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk")) returned 0xffffffff [0052.833] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0052.833] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0052.833] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0052.876] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46c [0052.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0052.876] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0052.883] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0052.931] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a94, nNumberOfBytesToRead=0x46c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a94*, lpNumberOfBytesRead=0x19ecac*=0x46c, lpOverlapped=0x0) returned 1 [0052.933] WriteFile (in: hFile=0x198, lpBuffer=0x1d46a94*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46a94*, lpNumberOfBytesWritten=0x19ecac*=0x470, lpOverlapped=0x0) returned 1 [0052.934] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0052.949] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0052.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0052.959] CloseHandle (hObject=0x190) returned 1 [0052.959] CloseHandle (hObject=0x198) returned 1 [0052.962] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0052.971] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0052.971] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0052.971] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0052.971] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0052.971] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 1 [0053.096] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0xffffffff [0053.096] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0053.097] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0053.099] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0053.115] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x484 [0053.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0053.115] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0053.122] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0053.201] ReadFile (in: hFile=0x198, lpBuffer=0x1d46b1c, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46b1c*, lpNumberOfBytesRead=0x19ecac*=0x484, lpOverlapped=0x0) returned 1 [0053.203] WriteFile (in: hFile=0x190, lpBuffer=0x1d46b1c*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46b1c*, lpNumberOfBytesWritten=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0053.204] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0053.232] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0053.236] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.242] CloseHandle (hObject=0x198) returned 1 [0053.242] CloseHandle (hObject=0x190) returned 1 [0053.247] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0053.255] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0053.255] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0053.255] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0053.256] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0053.256] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 1 [0053.258] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0xffffffff [0053.258] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0053.258] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0053.262] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0053.262] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0053.262] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0053.266] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f2 [0053.266] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0053.266] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0053.273] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0053.326] ReadFile (in: hFile=0x194, lpBuffer=0x1d469b8, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d469b8*, lpNumberOfBytesRead=0x19ef14*=0x3f2, lpOverlapped=0x0) returned 1 [0053.326] WriteFile (in: hFile=0x190, lpBuffer=0x1d469b8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d469b8*, lpNumberOfBytesWritten=0x19ef14*=0x400, lpOverlapped=0x0) returned 1 [0053.327] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0053.362] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0053.365] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.373] CloseHandle (hObject=0x194) returned 1 [0053.373] CloseHandle (hObject=0x190) returned 1 [0053.377] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0053.378] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0053.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0053.378] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0053.378] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0053.378] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0053.387] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0053.387] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0053.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0053.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0053.395] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x355 [0053.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0053.395] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0053.403] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0053.473] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b38, nNumberOfBytesToRead=0x355, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b38*, lpNumberOfBytesRead=0x19ef14*=0x355, lpOverlapped=0x0) returned 1 [0053.524] WriteFile (in: hFile=0x194, lpBuffer=0x1d46b38*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b38*, lpNumberOfBytesWritten=0x19ef14*=0x360, lpOverlapped=0x0) returned 1 [0053.525] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0053.554] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0053.558] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.565] CloseHandle (hObject=0x190) returned 1 [0053.565] CloseHandle (hObject=0x194) returned 1 [0053.572] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0053.573] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0053.573] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535300 [0053.573] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0053.573] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0053.574] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk")) returned 0 [0053.574] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Desktop.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.lnk")) returned 0x25 [0053.574] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0053.574] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0053.574] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0053.576] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x895 [0053.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0053.576] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0053.585] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0053.663] ReadFile (in: hFile=0x194, lpBuffer=0x1d46aa0, nNumberOfBytesToRead=0x895, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46aa0*, lpNumberOfBytesRead=0x19ef14*=0x895, lpOverlapped=0x0) returned 1 [0053.664] WriteFile (in: hFile=0x190, lpBuffer=0x1d46aa0*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46aa0*, lpNumberOfBytesWritten=0x19ef14*=0x8a0, lpOverlapped=0x0) returned 1 [0053.665] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0053.682] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0053.686] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.698] CloseHandle (hObject=0x194) returned 1 [0053.699] CloseHandle (hObject=0x190) returned 1 [0053.705] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0053.708] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0053.708] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535300 [0053.708] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0053.708] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0053.708] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk")) returned 0 [0053.709] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Devices Flow.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\devices flow.lnk")) returned 0x25 [0053.709] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0053.709] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0053.709] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0053.733] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x973 [0053.733] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0053.734] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0053.744] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0053.813] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b40, nNumberOfBytesToRead=0x973, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b40*, lpNumberOfBytesRead=0x19ef14*=0x973, lpOverlapped=0x0) returned 1 [0053.827] WriteFile (in: hFile=0x194, lpBuffer=0x1d46b40*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b40*, lpNumberOfBytesWritten=0x19ef14*=0x980, lpOverlapped=0x0) returned 1 [0053.828] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0053.861] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0053.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0053.876] CloseHandle (hObject=0x190) returned 1 [0053.876] CloseHandle (hObject=0x194) returned 1 [0053.934] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0053.935] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0053.935] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534d00 [0053.935] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0053.935] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0053.935] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 1 [0053.938] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 0xffffffff [0053.938] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0053.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0053.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0053.958] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x973 [0053.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0053.958] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0053.965] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0054.138] ReadFile (in: hFile=0x194, lpBuffer=0x1d46c0c, nNumberOfBytesToRead=0x973, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c0c*, lpNumberOfBytesRead=0x19ef14*=0x973, lpOverlapped=0x0) returned 1 [0054.145] WriteFile (in: hFile=0x190, lpBuffer=0x1d46c0c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c0c*, lpNumberOfBytesWritten=0x19ef14*=0x980, lpOverlapped=0x0) returned 1 [0054.146] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0054.161] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0054.165] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.172] CloseHandle (hObject=0x194) returned 1 [0054.172] CloseHandle (hObject=0x190) returned 1 [0054.173] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0054.174] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0054.174] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535340 [0054.175] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0054.175] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0054.175] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk")) returned 1 [0054.177] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel.lnk")) returned 0xffffffff [0054.177] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0054.177] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0054.177] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0054.179] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x92e [0054.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0054.179] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0054.188] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0054.264] ReadFile (in: hFile=0x190, lpBuffer=0x1d46ce8, nNumberOfBytesToRead=0x92e, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ce8*, lpNumberOfBytesRead=0x19ef14*=0x92e, lpOverlapped=0x0) returned 1 [0054.283] WriteFile (in: hFile=0x194, lpBuffer=0x1d46ce8*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ce8*, lpNumberOfBytesWritten=0x19ef14*=0x930, lpOverlapped=0x0) returned 1 [0054.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0054.306] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0054.310] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.350] CloseHandle (hObject=0x190) returned 1 [0054.350] CloseHandle (hObject=0x194) returned 1 [0054.377] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0054.378] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0054.378] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0054.379] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0054.379] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0054.379] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 1 [0054.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0xffffffff [0054.392] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0054.392] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0054.392] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0054.397] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x92d [0054.397] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0054.398] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0054.406] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0054.512] ReadFile (in: hFile=0x194, lpBuffer=0x1d46ddc, nNumberOfBytesToRead=0x92d, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ddc*, lpNumberOfBytesRead=0x19ef14*=0x92d, lpOverlapped=0x0) returned 1 [0054.513] WriteFile (in: hFile=0x190, lpBuffer=0x1d46ddc*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ddc*, lpNumberOfBytesWritten=0x19ef14*=0x930, lpOverlapped=0x0) returned 1 [0054.514] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0054.602] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0054.607] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.615] CloseHandle (hObject=0x194) returned 1 [0054.615] CloseHandle (hObject=0x190) returned 1 [0054.634] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0054.637] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0054.637] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535380 [0054.637] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0054.638] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0054.638] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk")) returned 0 [0054.638] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk")) returned 0x25 [0054.638] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0054.638] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535240 [0054.639] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0054.639] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0054.640] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0054.640] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0054.657] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x830 [0054.657] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0054.657] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0054.725] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0054.810] ReadFile (in: hFile=0x194, lpBuffer=0x1d46d44, nNumberOfBytesToRead=0x830, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d44*, lpNumberOfBytesRead=0x19ecac*=0x830, lpOverlapped=0x0) returned 1 [0054.861] WriteFile (in: hFile=0x198, lpBuffer=0x1d46d44*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d44*, lpNumberOfBytesWritten=0x19ecac*=0x840, lpOverlapped=0x0) returned 1 [0054.862] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0054.879] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0054.882] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0054.889] CloseHandle (hObject=0x194) returned 1 [0054.889] CloseHandle (hObject=0x198) returned 1 [0054.902] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0054.911] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0054.911] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534cc0 [0054.911] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0054.911] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0054.912] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 1 [0054.921] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0xffffffff [0054.921] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0054.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0054.938] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0055.130] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x842 [0055.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0055.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0055.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0055.210] ReadFile (in: hFile=0x198, lpBuffer=0x1d469e4, nNumberOfBytesToRead=0x842, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesRead=0x19ecac*=0x842, lpOverlapped=0x0) returned 1 [0055.231] WriteFile (in: hFile=0x194, lpBuffer=0x1d469e4*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d469e4*, lpNumberOfBytesWritten=0x19ecac*=0x850, lpOverlapped=0x0) returned 1 [0055.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0055.248] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0055.251] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.258] CloseHandle (hObject=0x198) returned 1 [0055.258] CloseHandle (hObject=0x194) returned 1 [0055.264] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0055.268] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0055.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534dc0 [0055.268] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0055.268] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0055.268] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 1 [0055.282] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0xffffffff [0055.282] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.282] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0055.282] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0055.307] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x818 [0055.307] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0055.308] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0055.314] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0055.388] ReadFile (in: hFile=0x194, lpBuffer=0x1d46bc8, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bc8*, lpNumberOfBytesRead=0x19ecac*=0x818, lpOverlapped=0x0) returned 1 [0055.389] WriteFile (in: hFile=0x198, lpBuffer=0x1d46bc8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bc8*, lpNumberOfBytesWritten=0x19ecac*=0x820, lpOverlapped=0x0) returned 1 [0055.390] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0055.405] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0055.409] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.420] CloseHandle (hObject=0x194) returned 1 [0055.420] CloseHandle (hObject=0x198) returned 1 [0055.439] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0055.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0055.538] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0055.538] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0055.538] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0055.538] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 1 [0055.562] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0xffffffff [0055.562] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.562] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.563] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0055.563] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0055.564] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0055.564] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0055.564] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.564] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.565] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0055.565] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0055.567] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0055.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0055.567] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0055.574] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0055.620] ReadFile (in: hFile=0x198, lpBuffer=0x1d46cb4, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46cb4*, lpNumberOfBytesRead=0x19ecac*=0xaa, lpOverlapped=0x0) returned 1 [0055.621] WriteFile (in: hFile=0x194, lpBuffer=0x1d46cb4*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46cb4*, lpNumberOfBytesWritten=0x19ecac*=0xb0, lpOverlapped=0x0) returned 1 [0055.622] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0055.638] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0055.641] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.649] CloseHandle (hObject=0x198) returned 1 [0055.649] CloseHandle (hObject=0x194) returned 1 [0055.650] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0055.652] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0055.652] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0055.652] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0055.652] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0055.652] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0055.653] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0055.653] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0055.653] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0055.654] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0055.654] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534dc0 [0055.655] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.655] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.655] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0055.655] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0055.656] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa03 [0055.656] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0055.657] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0055.663] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0055.710] ReadFile (in: hFile=0x194, lpBuffer=0x1d46c1c, nNumberOfBytesToRead=0xa03, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c1c*, lpNumberOfBytesRead=0x19ecac*=0xa03, lpOverlapped=0x0) returned 1 [0055.719] WriteFile (in: hFile=0x198, lpBuffer=0x1d46c1c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c1c*, lpNumberOfBytesWritten=0x19ecac*=0xa10, lpOverlapped=0x0) returned 1 [0055.719] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0055.736] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0055.741] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.747] CloseHandle (hObject=0x194) returned 1 [0055.747] CloseHandle (hObject=0x198) returned 1 [0055.749] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0055.750] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0055.750] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0055.750] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0055.750] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0055.751] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 1 [0055.752] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 0xffffffff [0055.752] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0055.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0055.754] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x988 [0055.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0055.754] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0055.761] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0055.810] ReadFile (in: hFile=0x198, lpBuffer=0x1d46bd8, nNumberOfBytesToRead=0x988, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bd8*, lpNumberOfBytesRead=0x19ecac*=0x988, lpOverlapped=0x0) returned 1 [0055.827] WriteFile (in: hFile=0x194, lpBuffer=0x1d46bd8*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46bd8*, lpNumberOfBytesWritten=0x19ecac*=0x990, lpOverlapped=0x0) returned 1 [0055.828] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0055.885] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0055.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0055.897] CloseHandle (hObject=0x198) returned 1 [0055.898] CloseHandle (hObject=0x194) returned 1 [0055.899] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0055.900] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0055.900] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0055.900] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0055.900] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0055.900] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 1 [0055.902] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 0xffffffff [0055.902] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0055.902] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0055.903] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0055.904] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa15 [0055.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0055.904] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0055.912] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0055.964] ReadFile (in: hFile=0x194, lpBuffer=0x1d46d04, nNumberOfBytesToRead=0xa15, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d04*, lpNumberOfBytesRead=0x19ecac*=0xa15, lpOverlapped=0x0) returned 1 [0055.975] WriteFile (in: hFile=0x198, lpBuffer=0x1d46d04*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d04*, lpNumberOfBytesWritten=0x19ecac*=0xa20, lpOverlapped=0x0) returned 1 [0055.976] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0055.991] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0055.995] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.002] CloseHandle (hObject=0x194) returned 1 [0056.002] CloseHandle (hObject=0x198) returned 1 [0056.084] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.086] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.086] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0056.086] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0056.086] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0056.086] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 1 [0056.088] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 0xffffffff [0056.088] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0056.088] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0056.088] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.090] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa10 [0056.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.090] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.097] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.146] ReadFile (in: hFile=0x198, lpBuffer=0x1d46c6c, nNumberOfBytesToRead=0xa10, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c6c*, lpNumberOfBytesRead=0x19ecac*=0xa10, lpOverlapped=0x0) returned 1 [0056.160] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c6c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c6c*, lpNumberOfBytesWritten=0x19ecac*=0xa20, lpOverlapped=0x0) returned 1 [0056.161] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.177] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.180] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.190] CloseHandle (hObject=0x198) returned 1 [0056.190] CloseHandle (hObject=0x194) returned 1 [0056.192] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.193] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.193] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0056.193] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0056.193] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0056.193] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk")) returned 1 [0056.195] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk")) returned 0xffffffff [0056.195] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0056.195] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.195] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0056.197] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a1 [0056.197] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.197] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.204] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.248] ReadFile (in: hFile=0x194, lpBuffer=0x1d46be8, nNumberOfBytesToRead=0x9a1, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46be8*, lpNumberOfBytesRead=0x19ecac*=0x9a1, lpOverlapped=0x0) returned 1 [0056.267] WriteFile (in: hFile=0x198, lpBuffer=0x1d46be8*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46be8*, lpNumberOfBytesWritten=0x19ecac*=0x9b0, lpOverlapped=0x0) returned 1 [0056.267] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.283] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.287] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.294] CloseHandle (hObject=0x194) returned 1 [0056.294] CloseHandle (hObject=0x198) returned 1 [0056.297] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.298] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.298] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0056.298] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0056.298] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0056.298] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 1 [0056.300] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 0xffffffff [0056.300] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0056.300] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0056.301] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.302] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0f [0056.302] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.302] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.309] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.382] ReadFile (in: hFile=0x198, lpBuffer=0x1d46d14, nNumberOfBytesToRead=0xa0f, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d14*, lpNumberOfBytesRead=0x19ecac*=0xa0f, lpOverlapped=0x0) returned 1 [0056.398] WriteFile (in: hFile=0x194, lpBuffer=0x1d46d14*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d14*, lpNumberOfBytesWritten=0x19ecac*=0xa10, lpOverlapped=0x0) returned 1 [0056.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.415] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.418] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.425] CloseHandle (hObject=0x198) returned 1 [0056.426] CloseHandle (hObject=0x194) returned 1 [0056.427] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.428] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0056.428] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0056.428] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0056.428] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 1 [0056.430] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 0xffffffff [0056.430] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0056.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0056.432] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d4 [0056.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.432] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.439] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.482] ReadFile (in: hFile=0x194, lpBuffer=0x1d46aec, nNumberOfBytesToRead=0x9d4, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46aec*, lpNumberOfBytesRead=0x19ecac*=0x9d4, lpOverlapped=0x0) returned 1 [0056.494] WriteFile (in: hFile=0x198, lpBuffer=0x1d46aec*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46aec*, lpNumberOfBytesWritten=0x19ecac*=0x9e0, lpOverlapped=0x0) returned 1 [0056.495] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.510] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.514] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.521] CloseHandle (hObject=0x194) returned 1 [0056.521] CloseHandle (hObject=0x198) returned 1 [0056.552] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.556] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.556] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0056.556] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0056.556] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0056.556] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 1 [0056.562] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 0xffffffff [0056.562] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0056.562] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0056.563] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.565] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa16 [0056.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.566] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.572] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.616] ReadFile (in: hFile=0x198, lpBuffer=0x1d46c20, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c20*, lpNumberOfBytesRead=0x19ecac*=0xa16, lpOverlapped=0x0) returned 1 [0056.619] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c20*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c20*, lpNumberOfBytesWritten=0x19ecac*=0xa20, lpOverlapped=0x0) returned 1 [0056.619] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.636] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.647] CloseHandle (hObject=0x198) returned 1 [0056.647] CloseHandle (hObject=0x194) returned 1 [0056.648] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.649] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.649] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0056.650] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0056.650] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0056.650] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 1 [0056.651] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 0xffffffff [0056.651] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0056.651] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0056.652] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0056.652] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0056.652] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.653] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ab [0056.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.653] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.660] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.703] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c78, nNumberOfBytesToRead=0x8ab, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c78*, lpNumberOfBytesRead=0x19ef14*=0x8ab, lpOverlapped=0x0) returned 1 [0056.719] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c78*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c78*, lpNumberOfBytesWritten=0x19ef14*=0x8b0, lpOverlapped=0x0) returned 1 [0056.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.735] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.739] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.746] CloseHandle (hObject=0x190) returned 1 [0056.746] CloseHandle (hObject=0x194) returned 1 [0056.747] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.747] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.747] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534c80 [0056.747] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0056.748] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0056.748] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk")) returned 0 [0056.748] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\miracastview.lnk")) returned 0x25 [0056.748] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0056.748] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.749] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0056.750] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d2 [0056.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.751] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.758] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.803] ReadFile (in: hFile=0x194, lpBuffer=0x1d46d5c, nNumberOfBytesToRead=0x4d2, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46d5c*, lpNumberOfBytesRead=0x19ef14*=0x4d2, lpOverlapped=0x0) returned 1 [0056.812] WriteFile (in: hFile=0x190, lpBuffer=0x1d46d5c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46d5c*, lpNumberOfBytesWritten=0x19ef14*=0x4e0, lpOverlapped=0x0) returned 1 [0056.813] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.869] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.872] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.880] CloseHandle (hObject=0x194) returned 1 [0056.881] CloseHandle (hObject=0x190) returned 1 [0056.883] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.885] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.885] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0056.885] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0056.885] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0056.885] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 1 [0056.888] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0xffffffff [0056.888] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0056.888] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0056.889] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.890] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89e [0056.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.890] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.897] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0056.939] ReadFile (in: hFile=0x190, lpBuffer=0x1d46e48, nNumberOfBytesToRead=0x89e, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e48*, lpNumberOfBytesRead=0x19ef14*=0x89e, lpOverlapped=0x0) returned 1 [0056.940] WriteFile (in: hFile=0x194, lpBuffer=0x1d46e48*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e48*, lpNumberOfBytesWritten=0x19ef14*=0x8a0, lpOverlapped=0x0) returned 1 [0056.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0056.956] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0056.960] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0056.966] CloseHandle (hObject=0x190) returned 1 [0056.966] CloseHandle (hObject=0x194) returned 1 [0056.967] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0056.968] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0056.968] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534f40 [0056.968] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0056.968] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0056.968] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 1 [0056.969] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 0xffffffff [0056.969] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0056.970] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0056.971] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0056.974] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95f [0056.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0056.974] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0056.981] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.195] ReadFile (in: hFile=0x194, lpBuffer=0x1d46db0, nNumberOfBytesToRead=0x95f, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46db0*, lpNumberOfBytesRead=0x19ef14*=0x95f, lpOverlapped=0x0) returned 1 [0057.207] WriteFile (in: hFile=0x190, lpBuffer=0x1d46db0*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46db0*, lpNumberOfBytesWritten=0x19ef14*=0x960, lpOverlapped=0x0) returned 1 [0057.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.223] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.227] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.233] CloseHandle (hObject=0x194) returned 1 [0057.234] CloseHandle (hObject=0x190) returned 1 [0057.234] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535380 [0057.235] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.235] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0057.235] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 1 [0057.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 0xffffffff [0057.236] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.236] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.238] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.239] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96d [0057.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.239] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.246] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.289] ReadFile (in: hFile=0x190, lpBuffer=0x1d46a3c, nNumberOfBytesToRead=0x96d, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46a3c*, lpNumberOfBytesRead=0x19ef14*=0x96d, lpOverlapped=0x0) returned 1 [0057.290] WriteFile (in: hFile=0x194, lpBuffer=0x1d46a3c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46a3c*, lpNumberOfBytesWritten=0x19ef14*=0x970, lpOverlapped=0x0) returned 1 [0057.291] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.308] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.313] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.321] CloseHandle (hObject=0x190) returned 1 [0057.321] CloseHandle (hObject=0x194) returned 1 [0057.322] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.322] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.322] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535080 [0057.322] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.322] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0057.323] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 1 [0057.324] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 0xffffffff [0057.324] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.324] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.324] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.325] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96d [0057.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.325] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.333] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.408] ReadFile (in: hFile=0x194, lpBuffer=0x1d46b70, nNumberOfBytesToRead=0x96d, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b70*, lpNumberOfBytesRead=0x19ef14*=0x96d, lpOverlapped=0x0) returned 1 [0057.541] WriteFile (in: hFile=0x190, lpBuffer=0x1d46b70*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b70*, lpNumberOfBytesWritten=0x19ef14*=0x970, lpOverlapped=0x0) returned 1 [0057.542] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.558] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.562] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.569] CloseHandle (hObject=0x194) returned 1 [0057.570] CloseHandle (hObject=0x190) returned 1 [0057.570] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.571] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.571] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534dc0 [0057.571] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.571] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0057.571] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk")) returned 1 [0057.572] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook.lnk")) returned 0xffffffff [0057.572] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.573] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.573] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.573] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x998 [0057.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.574] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.580] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.623] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c54, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c54*, lpNumberOfBytesRead=0x19ef14*=0x998, lpOverlapped=0x0) returned 1 [0057.624] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c54*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c54*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0057.625] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.641] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.645] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.651] CloseHandle (hObject=0x190) returned 1 [0057.651] CloseHandle (hObject=0x194) returned 1 [0057.653] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.654] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.654] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0057.654] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.654] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0057.654] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 1 [0057.655] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 0xffffffff [0057.656] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.656] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.656] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.658] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x998 [0057.658] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.658] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.665] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.709] ReadFile (in: hFile=0x194, lpBuffer=0x1d46bbc, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46bbc*, lpNumberOfBytesRead=0x19ef14*=0x998, lpOverlapped=0x0) returned 1 [0057.710] WriteFile (in: hFile=0x190, lpBuffer=0x1d46bbc*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46bbc*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0057.711] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.727] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.731] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.737] CloseHandle (hObject=0x194) returned 1 [0057.738] CloseHandle (hObject=0x190) returned 1 [0057.739] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.740] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.740] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534f40 [0057.740] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.740] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0057.740] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk")) returned 1 [0057.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint.lnk")) returned 0xffffffff [0057.742] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.743] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.745] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x897 [0057.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.745] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.752] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.795] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b48, nNumberOfBytesToRead=0x897, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b48*, lpNumberOfBytesRead=0x19ef14*=0x897, lpOverlapped=0x0) returned 1 [0057.796] WriteFile (in: hFile=0x194, lpBuffer=0x1d46b48*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b48*, lpNumberOfBytesWritten=0x19ef14*=0x8a0, lpOverlapped=0x0) returned 1 [0057.797] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.812] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.816] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.823] CloseHandle (hObject=0x190) returned 1 [0057.823] CloseHandle (hObject=0x194) returned 1 [0057.825] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.826] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.826] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534dc0 [0057.826] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.826] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0057.826] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk")) returned 0 [0057.826] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\printdialog.lnk")) returned 0x25 [0057.827] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.827] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.827] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.828] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a3 [0057.829] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.829] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.836] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0057.905] ReadFile (in: hFile=0x194, lpBuffer=0x1d46c24, nNumberOfBytesToRead=0x9a3, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c24*, lpNumberOfBytesRead=0x19ef14*=0x9a3, lpOverlapped=0x0) returned 1 [0057.958] WriteFile (in: hFile=0x190, lpBuffer=0x1d46c24*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c24*, lpNumberOfBytesWritten=0x19ef14*=0x9b0, lpOverlapped=0x0) returned 1 [0057.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0057.974] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0057.978] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0057.985] CloseHandle (hObject=0x194) returned 1 [0057.985] CloseHandle (hObject=0x190) returned 1 [0057.986] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0057.986] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0057.986] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535400 [0057.986] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0057.986] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0057.987] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk")) returned 1 [0057.988] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project 2016.lnk")) returned 0xffffffff [0057.988] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0057.988] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0057.988] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0057.989] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x87e [0057.989] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0057.989] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0057.996] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.101] ReadFile (in: hFile=0x190, lpBuffer=0x1d46cf8, nNumberOfBytesToRead=0x87e, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46cf8*, lpNumberOfBytesRead=0x19ef14*=0x87e, lpOverlapped=0x0) returned 1 [0058.116] WriteFile (in: hFile=0x194, lpBuffer=0x1d46cf8*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46cf8*, lpNumberOfBytesWritten=0x19ef14*=0x880, lpOverlapped=0x0) returned 1 [0058.117] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.133] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.137] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.143] CloseHandle (hObject=0x190) returned 1 [0058.143] CloseHandle (hObject=0x194) returned 1 [0058.145] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.146] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.146] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0058.146] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0058.146] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0058.146] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk")) returned 1 [0058.148] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Project.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\project.lnk")) returned 0xffffffff [0058.148] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.148] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.149] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0058.150] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x967 [0058.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.150] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.157] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.199] ReadFile (in: hFile=0x194, lpBuffer=0x1d46c60, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c60*, lpNumberOfBytesRead=0x19ef14*=0x967, lpOverlapped=0x0) returned 1 [0058.200] WriteFile (in: hFile=0x190, lpBuffer=0x1d46c60*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c60*, lpNumberOfBytesWritten=0x19ef14*=0x970, lpOverlapped=0x0) returned 1 [0058.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.218] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.224] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.230] CloseHandle (hObject=0x194) returned 1 [0058.230] CloseHandle (hObject=0x190) returned 1 [0058.231] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0058.232] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0058.232] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0058.232] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 1 [0058.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 0xffffffff [0058.233] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0058.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.234] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x967 [0058.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.234] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.242] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.283] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b40, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b40*, lpNumberOfBytesRead=0x19ef14*=0x967, lpOverlapped=0x0) returned 1 [0058.285] WriteFile (in: hFile=0x194, lpBuffer=0x1d46b40*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46b40*, lpNumberOfBytesWritten=0x19ef14*=0x970, lpOverlapped=0x0) returned 1 [0058.286] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.301] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.304] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.311] CloseHandle (hObject=0x190) returned 1 [0058.311] CloseHandle (hObject=0x194) returned 1 [0058.312] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0058.314] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0058.314] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0058.314] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk")) returned 1 [0058.315] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher.lnk")) returned 0xffffffff [0058.315] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0058.317] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x634 [0058.317] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.317] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.324] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.398] ReadFile (in: hFile=0x194, lpBuffer=0x1d46c0c, nNumberOfBytesToRead=0x634, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c0c*, lpNumberOfBytesRead=0x19ef14*=0x634, lpOverlapped=0x0) returned 1 [0058.400] WriteFile (in: hFile=0x190, lpBuffer=0x1d46c0c*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46c0c*, lpNumberOfBytesWritten=0x19ef14*=0x640, lpOverlapped=0x0) returned 1 [0058.401] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.416] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.420] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.426] CloseHandle (hObject=0x194) returned 1 [0058.427] CloseHandle (hObject=0x190) returned 1 [0058.428] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535400 [0058.429] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0058.429] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0058.429] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk")) returned 0 [0058.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Search.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\search.lnk")) returned 0x25 [0058.429] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0058.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.431] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99e [0058.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.432] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.438] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.480] ReadFile (in: hFile=0x190, lpBuffer=0x1d46d00, nNumberOfBytesToRead=0x99e, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46d00*, lpNumberOfBytesRead=0x19ef14*=0x99e, lpOverlapped=0x0) returned 1 [0058.482] WriteFile (in: hFile=0x194, lpBuffer=0x1d46d00*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46d00*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0058.482] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.497] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.508] CloseHandle (hObject=0x190) returned 1 [0058.508] CloseHandle (hObject=0x194) returned 1 [0058.509] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.510] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.510] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5353c0 [0058.510] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0058.510] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0058.510] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 1 [0058.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 0xffffffff [0058.512] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.512] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.512] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0058.522] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99e [0058.523] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.523] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.530] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.580] ReadFile (in: hFile=0x194, lpBuffer=0x1d46de4, nNumberOfBytesToRead=0x99e, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46de4*, lpNumberOfBytesRead=0x19ef14*=0x99e, lpOverlapped=0x0) returned 1 [0058.583] WriteFile (in: hFile=0x190, lpBuffer=0x1d46de4*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46de4*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0058.587] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.602] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.605] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.612] CloseHandle (hObject=0x194) returned 1 [0058.613] CloseHandle (hObject=0x190) returned 1 [0058.614] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.615] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0058.615] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0058.615] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0058.615] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk")) returned 1 [0058.617] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business.lnk")) returned 0xffffffff [0058.617] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.617] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0058.617] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0058.617] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0058.617] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.617] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0058.618] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0058.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.618] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.625] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.669] ReadFile (in: hFile=0x194, lpBuffer=0x1d46d38, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d38*, lpNumberOfBytesRead=0x19ecac*=0xae, lpOverlapped=0x0) returned 1 [0058.669] WriteFile (in: hFile=0x198, lpBuffer=0x1d46d38*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d38*, lpNumberOfBytesWritten=0x19ecac*=0xb0, lpOverlapped=0x0) returned 1 [0058.670] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.686] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.689] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.697] CloseHandle (hObject=0x194) returned 1 [0058.697] CloseHandle (hObject=0x198) returned 1 [0058.698] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0058.699] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0058.699] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0058.700] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0058.701] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0058.701] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0058.701] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0058.702] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0058.702] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534ec0 [0058.702] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0058.702] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0058.702] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0058.702] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.704] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e3 [0058.704] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.704] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.711] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.757] ReadFile (in: hFile=0x198, lpBuffer=0x1d46c90, nNumberOfBytesToRead=0x4e3, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c90*, lpNumberOfBytesRead=0x19ecac*=0x4e3, lpOverlapped=0x0) returned 1 [0058.758] WriteFile (in: hFile=0x194, lpBuffer=0x1d46c90*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c90*, lpNumberOfBytesWritten=0x19ecac*=0x4f0, lpOverlapped=0x0) returned 1 [0058.759] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.774] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.797] CloseHandle (hObject=0x198) returned 1 [0058.797] CloseHandle (hObject=0x194) returned 1 [0058.805] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.806] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.806] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0058.806] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0058.806] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0058.806] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk")) returned 1 [0058.807] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\default programs.lnk")) returned 0xffffffff [0058.807] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0058.807] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.807] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0058.813] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c2 [0058.813] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.813] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.820] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.880] ReadFile (in: hFile=0x194, lpBuffer=0x1d46d7c, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d7c*, lpNumberOfBytesRead=0x19ecac*=0x1c2, lpOverlapped=0x0) returned 1 [0058.881] WriteFile (in: hFile=0x198, lpBuffer=0x1d46d7c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46d7c*, lpNumberOfBytesWritten=0x19ecac*=0x1d0, lpOverlapped=0x0) returned 1 [0058.881] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.897] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.902] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0058.912] CloseHandle (hObject=0x194) returned 1 [0058.912] CloseHandle (hObject=0x198) returned 1 [0058.913] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0058.914] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0058.914] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0058.914] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0058.914] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0058.914] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 1 [0058.916] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini")) returned 0xffffffff [0058.916] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0058.916] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0058.917] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0058.917] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x460 [0058.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0058.918] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0058.928] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0058.973] ReadFile (in: hFile=0x198, lpBuffer=0x1d46e70, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e70*, lpNumberOfBytesRead=0x19ecac*=0x460, lpOverlapped=0x0) returned 1 [0058.974] WriteFile (in: hFile=0x194, lpBuffer=0x1d46e70*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e70*, lpNumberOfBytesWritten=0x19ecac*=0x470, lpOverlapped=0x0) returned 1 [0058.975] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0058.991] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0058.995] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.001] CloseHandle (hObject=0x198) returned 1 [0059.002] CloseHandle (hObject=0x194) returned 1 [0059.002] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.109] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.110] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0059.110] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0059.110] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0059.110] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk")) returned 1 [0059.110] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk")) returned 0xffffffff [0059.110] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0059.110] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0059.111] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0059.111] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0059.111] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0059.111] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0059.111] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0059.111] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0059.111] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.113] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0059.114] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x991 [0059.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.114] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.121] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.164] ReadFile (in: hFile=0x190, lpBuffer=0x1d46f44, nNumberOfBytesToRead=0x991, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f44*, lpNumberOfBytesRead=0x19ef14*=0x991, lpOverlapped=0x0) returned 1 [0059.184] WriteFile (in: hFile=0x194, lpBuffer=0x1d46f44*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f44*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0059.185] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.202] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.207] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.214] CloseHandle (hObject=0x190) returned 1 [0059.214] CloseHandle (hObject=0x194) returned 1 [0059.215] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.215] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.215] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534f40 [0059.215] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0059.215] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0059.216] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk")) returned 1 [0059.217] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk")) returned 0xffffffff [0059.217] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0059.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0059.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.218] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86e [0059.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.218] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.225] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.271] ReadFile (in: hFile=0x194, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ef14*=0x86e, lpOverlapped=0x0) returned 1 [0059.284] WriteFile (in: hFile=0x190, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ef14*=0x870, lpOverlapped=0x0) returned 1 [0059.285] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.300] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.304] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.311] CloseHandle (hObject=0x194) returned 1 [0059.311] CloseHandle (hObject=0x190) returned 1 [0059.312] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.313] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535080 [0059.313] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0059.313] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0059.313] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk")) returned 1 [0059.314] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Visio.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\visio.lnk")) returned 0xffffffff [0059.314] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0059.315] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0059.317] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x999 [0059.317] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.317] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.324] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.367] ReadFile (in: hFile=0x190, lpBuffer=0x1d47024, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47024*, lpNumberOfBytesRead=0x19ef14*=0x999, lpOverlapped=0x0) returned 1 [0059.368] WriteFile (in: hFile=0x194, lpBuffer=0x1d47024*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47024*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0059.369] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.385] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.396] CloseHandle (hObject=0x190) returned 1 [0059.396] CloseHandle (hObject=0x194) returned 1 [0059.397] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.397] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.397] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535400 [0059.398] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0059.398] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0059.398] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk")) returned 1 [0059.399] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk")) returned 0xffffffff [0059.399] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0059.399] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0059.399] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.400] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x999 [0059.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.400] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.407] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.452] ReadFile (in: hFile=0x194, lpBuffer=0x1d46ab0, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ab0*, lpNumberOfBytesRead=0x19ef14*=0x999, lpOverlapped=0x0) returned 1 [0059.473] WriteFile (in: hFile=0x190, lpBuffer=0x1d46ab0*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ab0*, lpNumberOfBytesWritten=0x19ef14*=0x9a0, lpOverlapped=0x0) returned 1 [0059.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.489] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.499] CloseHandle (hObject=0x194) returned 1 [0059.499] CloseHandle (hObject=0x190) returned 1 [0059.500] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.501] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.501] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535180 [0059.501] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0059.501] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0059.501] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk")) returned 1 [0059.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word.lnk")) returned 0xffffffff [0059.502] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0059.502] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0059.502] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0059.502] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0059.503] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0059.503] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0059.503] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.503] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.504] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.505] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.505] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x493 [0059.505] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.506] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.512] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.564] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46b1c, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b1c*, lpNumberOfBytesRead=0x19f17c*=0x493, lpOverlapped=0x0) returned 1 [0059.566] WriteFile (in: hFile=0x190, lpBuffer=0x1d46b1c*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b1c*, lpNumberOfBytesWritten=0x19f17c*=0x4a0, lpOverlapped=0x0) returned 1 [0059.567] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.582] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.586] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.593] CloseHandle (hObject=0x18c) returned 1 [0059.593] CloseHandle (hObject=0x190) returned 1 [0059.595] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.595] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.595] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0059.595] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0059.595] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0059.596] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk")) returned 1 [0059.596] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\01 - File Explorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\01 - file explorer.lnk")) returned 0xffffffff [0059.597] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.597] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.597] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.598] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x151 [0059.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.598] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.606] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.649] ReadFile (in: hFile=0x190, lpBuffer=0x1d46b58, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b58*, lpNumberOfBytesRead=0x19f17c*=0x151, lpOverlapped=0x0) returned 1 [0059.651] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46b58*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b58*, lpNumberOfBytesWritten=0x19f17c*=0x160, lpOverlapped=0x0) returned 1 [0059.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.668] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.671] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.678] CloseHandle (hObject=0x190) returned 1 [0059.679] CloseHandle (hObject=0x18c) returned 1 [0059.680] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.680] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.680] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x5351c0 [0059.681] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0059.681] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0059.681] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk")) returned 1 [0059.681] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\03 - Documents.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\03 - documents.lnk")) returned 0xffffffff [0059.682] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.682] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.682] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.683] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x151 [0059.683] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.684] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.691] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.733] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46b98, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b98*, lpNumberOfBytesRead=0x19f17c*=0x151, lpOverlapped=0x0) returned 1 [0059.734] WriteFile (in: hFile=0x190, lpBuffer=0x1d46b98*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46b98*, lpNumberOfBytesWritten=0x19f17c*=0x160, lpOverlapped=0x0) returned 1 [0059.735] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.754] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.761] CloseHandle (hObject=0x18c) returned 1 [0059.761] CloseHandle (hObject=0x190) returned 1 [0059.762] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.763] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.763] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x5353c0 [0059.763] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0059.763] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0059.763] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk")) returned 1 [0059.764] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\04 - Downloads.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\04 - downloads.lnk")) returned 0xffffffff [0059.764] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.764] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.765] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149 [0059.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.766] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.773] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.819] ReadFile (in: hFile=0x190, lpBuffer=0x1d46bcc, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46bcc*, lpNumberOfBytesRead=0x19f17c*=0x149, lpOverlapped=0x0) returned 1 [0059.820] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46bcc*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46bcc*, lpNumberOfBytesWritten=0x19f17c*=0x150, lpOverlapped=0x0) returned 1 [0059.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.837] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.840] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.847] CloseHandle (hObject=0x190) returned 1 [0059.848] CloseHandle (hObject=0x18c) returned 1 [0059.849] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.850] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.850] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534dc0 [0059.850] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0059.850] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0059.850] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk")) returned 1 [0059.851] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\05 - Music.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\05 - music.lnk")) returned 0xffffffff [0059.851] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.851] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.852] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.852] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x151 [0059.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.853] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.860] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.906] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46c10, nNumberOfBytesToRead=0x151, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46c10*, lpNumberOfBytesRead=0x19f17c*=0x151, lpOverlapped=0x0) returned 1 [0059.907] WriteFile (in: hFile=0x190, lpBuffer=0x1d46c10*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46c10*, lpNumberOfBytesWritten=0x19f17c*=0x160, lpOverlapped=0x0) returned 1 [0059.908] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0059.928] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0059.932] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0059.941] CloseHandle (hObject=0x18c) returned 1 [0059.941] CloseHandle (hObject=0x190) returned 1 [0059.942] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0059.943] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0059.943] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535380 [0059.943] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0059.943] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0059.943] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk")) returned 1 [0059.944] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\06 - Pictures.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\06 - pictures.lnk")) returned 0xffffffff [0059.944] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0059.944] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0059.945] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0059.946] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14d [0059.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0059.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0059.953] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0059.996] ReadFile (in: hFile=0x190, lpBuffer=0x1d46c44, nNumberOfBytesToRead=0x14d, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46c44*, lpNumberOfBytesRead=0x19f17c*=0x14d, lpOverlapped=0x0) returned 1 [0059.997] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46c44*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46c44*, lpNumberOfBytesWritten=0x19f17c*=0x150, lpOverlapped=0x0) returned 1 [0059.997] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0060.013] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0060.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.129] CloseHandle (hObject=0x190) returned 1 [0060.129] CloseHandle (hObject=0x18c) returned 1 [0060.130] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0060.131] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0060.131] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534f40 [0060.131] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0060.131] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0060.131] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk")) returned 1 [0060.132] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\07 - Videos.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\07 - videos.lnk")) returned 0xffffffff [0060.132] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.133] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0060.133] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0060.134] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0060.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0060.134] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0060.141] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0060.196] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46d48, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46d48*, lpNumberOfBytesRead=0x19f17c*=0x117, lpOverlapped=0x0) returned 1 [0060.197] WriteFile (in: hFile=0x190, lpBuffer=0x1d46d48*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46d48*, lpNumberOfBytesWritten=0x19f17c*=0x120, lpOverlapped=0x0) returned 1 [0060.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0060.219] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0060.224] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.235] CloseHandle (hObject=0x18c) returned 1 [0060.236] CloseHandle (hObject=0x190) returned 1 [0060.237] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0060.238] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0060.238] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534dc0 [0060.238] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0060.238] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0060.238] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk")) returned 1 [0060.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\08 - Homegroup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\08 - homegroup.lnk")) returned 0xffffffff [0060.240] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.240] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0060.240] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0060.241] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113 [0060.241] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0060.242] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0060.251] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0060.308] ReadFile (in: hFile=0x190, lpBuffer=0x1d46d30, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46d30*, lpNumberOfBytesRead=0x19f17c*=0x113, lpOverlapped=0x0) returned 1 [0060.310] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46d30*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46d30*, lpNumberOfBytesWritten=0x19f17c*=0x120, lpOverlapped=0x0) returned 1 [0060.311] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0060.334] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0060.340] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.349] CloseHandle (hObject=0x190) returned 1 [0060.349] CloseHandle (hObject=0x18c) returned 1 [0060.350] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0060.351] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0060.351] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535240 [0060.351] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0060.351] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0060.351] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk")) returned 1 [0060.352] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\09 - Network.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\09 - network.lnk")) returned 0xffffffff [0060.352] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.352] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0060.352] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0060.353] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x141 [0060.353] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0060.353] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0060.361] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0060.417] ReadFile (in: hFile=0x18c, lpBuffer=0x1d46ecc, nNumberOfBytesToRead=0x141, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46ecc*, lpNumberOfBytesRead=0x19f17c*=0x141, lpOverlapped=0x0) returned 1 [0060.421] WriteFile (in: hFile=0x190, lpBuffer=0x1d46ecc*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46ecc*, lpNumberOfBytesWritten=0x19f17c*=0x150, lpOverlapped=0x0) returned 1 [0060.422] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0060.439] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0060.442] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.450] CloseHandle (hObject=0x18c) returned 1 [0060.450] CloseHandle (hObject=0x190) returned 1 [0060.451] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0060.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0060.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535240 [0060.452] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0060.452] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0060.452] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk")) returned 1 [0060.453] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\10 - UserProfile.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\10 - userprofile.lnk")) returned 0xffffffff [0060.453] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.453] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0060.453] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0060.455] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x240 [0060.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0060.455] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0060.462] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0060.505] ReadFile (in: hFile=0x190, lpBuffer=0x1d46f98, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46f98*, lpNumberOfBytesRead=0x19f17c*=0x240, lpOverlapped=0x0) returned 1 [0060.506] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46f98*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d46f98*, lpNumberOfBytesWritten=0x19f17c*=0x250, lpOverlapped=0x0) returned 1 [0060.506] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0060.622] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0060.625] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.632] CloseHandle (hObject=0x190) returned 1 [0060.632] CloseHandle (hObject=0x18c) returned 1 [0060.633] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0060.634] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0060.634] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0060.634] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0060.634] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0060.634] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini")) returned 1 [0060.635] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu Places\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu places\\desktop.ini")) returned 0xffffffff [0060.635] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0060.635] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0060.635] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0060.636] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535240 [0060.636] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.636] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0060.636] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0060.636] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0060.636] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0060.636] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.636] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.636] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0060.674] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.674] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0060.674] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0060.674] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.674] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0060.674] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.674] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0060.674] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0060.674] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.674] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\Temp\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0060.675] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.675] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0060.675] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0060.675] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0060.675] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0060.675] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0060.675] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0060.675] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0060.675] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534c80 [0060.679] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0060.679] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0060.679] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Clean Store\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0060.681] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.681] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0060.681] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0060.681] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0060.681] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0060.681] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.681] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.681] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0060.681] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.681] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0060.681] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0060.682] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0060.682] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0060.751] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.752] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0060.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0060.753] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121e10 [0060.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0060.753] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0060.761] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0060.819] ReadFile (in: hFile=0x190, lpBuffer=0x1d46f3c, nNumberOfBytesToRead=0x121e10, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f3c*, lpNumberOfBytesRead=0x19ef14*=0x121e10, lpOverlapped=0x0) returned 1 [0060.886] WriteFile (in: hFile=0x194, lpBuffer=0x1d46f3c*, nNumberOfBytesToWrite=0x121e20, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f3c*, lpNumberOfBytesWritten=0x19ef14*=0x121e20, lpOverlapped=0x0) returned 1 [0060.910] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0060.929] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0060.933] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0060.939] CloseHandle (hObject=0x190) returned 1 [0060.940] CloseHandle (hObject=0x194) returned 1 [0060.979] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0060.979] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0060.979] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e40 [0060.979] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0060.979] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0060.979] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll")) returned 0 [0060.980] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\GapaEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\gapaengine.dll")) returned 0x20 [0060.980] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.980] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.981] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.981] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.982] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0060.982] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0060.982] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0060.983] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba6028 [0060.983] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0060.983] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0060.990] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0061.160] ReadFile (in: hFile=0x194, lpBuffer=0x1d46f64, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f64*, lpNumberOfBytesRead=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0061.430] WriteFile (in: hFile=0x190, lpBuffer=0x1d46f64*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f64*, lpNumberOfBytesWritten=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0061.528] ReadFile (in: hFile=0x194, lpBuffer=0x1d46f64, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f64*, lpNumberOfBytesRead=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0061.735] WriteFile (in: hFile=0x190, lpBuffer=0x1d46f64*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f64*, lpNumberOfBytesWritten=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0061.818] ReadFile (in: hFile=0x194, lpBuffer=0x1d46f64, nNumberOfBytesToRead=0x1a6028, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f64*, lpNumberOfBytesRead=0x19ef14*=0x1a6028, lpOverlapped=0x0) returned 1 [0061.864] WriteFile (in: hFile=0x190, lpBuffer=0x1d46f64*, nNumberOfBytesToWrite=0x1a6030, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f64*, lpNumberOfBytesWritten=0x19ef14*=0x1a6030, lpOverlapped=0x0) returned 1 [0061.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0061.923] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0061.927] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0061.934] CloseHandle (hObject=0x194) returned 1 [0061.934] CloseHandle (hObject=0x190) returned 1 [0062.257] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.257] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0062.257] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0062.258] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0062.258] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0062.258] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll")) returned 0 [0062.258] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Default\\MpEngine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\default\\mpengine.dll")) returned 0x20 [0062.258] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.259] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.259] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.259] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0062.259] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.259] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\NisBackup\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0062.277] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.277] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.278] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.278] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0062.278] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.278] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0062.278] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0062.278] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Features\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535080 [0062.278] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0062.278] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0062.278] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0062.278] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0062.279] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.279] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0062.279] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0062.279] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0062.279] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535380 [0062.294] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.294] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5353c0 [0062.294] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.295] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0062.310] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0062.370] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x87f9 [0062.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0062.370] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0062.377] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0062.431] ReadFile (in: hFile=0x190, lpBuffer=0x1d45a68, nNumberOfBytesToRead=0x87f9, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d45a68*, lpNumberOfBytesRead=0x19ef14*=0x87f9, lpOverlapped=0x0) returned 1 [0062.485] WriteFile (in: hFile=0x194, lpBuffer=0x1d45a68*, nNumberOfBytesToWrite=0x8800, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d45a68*, lpNumberOfBytesWritten=0x19ef14*=0x8800, lpOverlapped=0x0) returned 1 [0062.486] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0062.502] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0062.506] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.514] CloseHandle (hObject=0x190) returned 1 [0062.514] CloseHandle (hObject=0x194) returned 1 [0062.515] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.515] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0062.516] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534cc0 [0062.516] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0062.516] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0062.516] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 1 [0062.517] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Network Inspection System\\Support\\NisLog.txt" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\network inspection system\\support\\nislog.txt")) returned 0xffffffff [0062.517] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.517] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0062.517] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0062.517] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0062.517] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0062.517] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534d00 [0062.518] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.518] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0062.518] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.518] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0062.518] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0062.528] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.530] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.530] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanFileTelemetry\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0062.531] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.531] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.531] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.531] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.531] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534ec0 [0062.532] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.532] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Entries\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0062.532] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.532] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.532] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0062.532] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\ResourceData\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0062.532] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.532] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.532] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.532] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.532] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\CleanStore\\Resources\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0062.533] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.533] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.533] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.533] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.533] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0062.533] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.533] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5353c0 [0062.583] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.584] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.584] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0062.584] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.584] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.584] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpscancache-1.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0062.584] CloseHandle (hObject=0xffffffff) returned 1 [0062.584] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpscancache-1.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpscancache-1.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.584] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpscancache-1.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0062.585] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0062.585] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0062.585] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0062.585] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpscancache-1.bin")) returned 1 [0062.585] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\MpScanCache-1.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\cachemanager\\mpscancache-1.bin")) returned 0xffffffff [0062.585] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.585] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.586] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.586] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0062.586] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.586] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.586] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0062.591] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.591] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.591] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\00\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0062.591] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.591] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.592] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.592] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.592] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.592] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\01\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0062.592] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.592] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.592] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.593] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.594] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.594] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\02\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535180 [0062.594] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.594] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.594] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.594] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\03\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535200 [0062.595] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.595] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.595] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.595] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0062.595] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.595] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\04\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.595] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.595] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.595] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.596] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.596] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.596] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.596] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\05\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.597] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.597] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.597] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.598] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.598] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.598] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.598] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.598] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\06\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535180 [0062.598] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.598] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.599] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.599] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.599] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\07\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.599] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.599] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.599] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.599] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.599] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.599] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\09\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534f40 [0062.600] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.600] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.600] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.600] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.601] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.601] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0062.601] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.601] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\10\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535180 [0062.601] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.601] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.601] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.602] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.602] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.602] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.602] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\11\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0062.603] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.603] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.604] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.604] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.604] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.604] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\12\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535180 [0062.604] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.604] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.604] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.604] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.606] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.606] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\13\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0062.607] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.607] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.607] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.607] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0062.607] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.607] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\14\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.607] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.607] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.608] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.608] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.608] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.608] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\15\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e80 [0062.608] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.608] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.608] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.609] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.609] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.609] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.609] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0062.609] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.609] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\17\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.611] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.611] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.611] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.611] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.611] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.611] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.611] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\18\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.611] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.612] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.612] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.612] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.613] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.613] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.613] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.613] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\19\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0062.613] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.613] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.613] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.614] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.614] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.614] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.614] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.614] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\20\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e40 [0062.615] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.615] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.615] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.615] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0062.615] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.616] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\21\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0062.616] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.616] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.616] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.616] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.616] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.616] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.616] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Mput\\MputHistory\\22\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e40 [0062.619] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.619] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0062.619] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0062.619] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0062.619] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0062.619] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0062.619] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.619] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0062.619] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.619] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\RemCheck\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535180 [0062.621] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.621] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.621] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0062.621] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0062.621] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.621] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.621] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0062.621] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.621] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0062.622] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.622] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.622] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0062.622] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0062.623] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0062.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0062.624] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0062.630] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0062.674] ReadFile (in: hFile=0x190, lpBuffer=0x1d46910, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46910*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0062.679] WriteFile (in: hFile=0x198, lpBuffer=0x1d46910*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46910*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0062.680] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0062.697] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0062.701] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.708] CloseHandle (hObject=0x190) returned 1 [0062.708] CloseHandle (hObject=0x198) returned 1 [0062.709] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.709] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0062.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0062.709] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0062.709] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0062.709] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log")) returned 1 [0062.710] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\Unknown.Log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\history\\service\\unknown.log")) returned 0xffffffff [0062.710] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.710] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0062.711] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.711] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0062.711] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.711] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.711] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0062.711] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0062.713] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0062.713] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0062.713] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0062.723] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.723] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0062.723] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.723] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0062.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0062.724] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0062.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0062.724] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0062.732] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0062.778] ReadFile (in: hFile=0x198, lpBuffer=0x1d46c44, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c44*, lpNumberOfBytesRead=0x19ecac*=0x50, lpOverlapped=0x0) returned 1 [0062.779] WriteFile (in: hFile=0x190, lpBuffer=0x1d46c44*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46c44*, lpNumberOfBytesWritten=0x19ecac*=0x60, lpOverlapped=0x0) returned 1 [0062.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0062.795] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0062.799] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.806] CloseHandle (hObject=0x198) returned 1 [0062.806] CloseHandle (hObject=0x190) returned 1 [0062.807] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.807] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0062.807] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0062.807] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0062.807] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0062.808] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx")) returned 1 [0062.808] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\1\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\1\\0000000000000000.idx")) returned 0xffffffff [0062.809] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0062.809] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0062.809] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0062.809] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0062.809] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.809] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.809] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0062.809] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0062.812] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0062.812] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0062.812] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0062.819] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0062.863] ReadFile (in: hFile=0x190, lpBuffer=0x1d46e18, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e18*, lpNumberOfBytesRead=0x19ecac*=0x50, lpOverlapped=0x0) returned 1 [0062.864] WriteFile (in: hFile=0x198, lpBuffer=0x1d46e18*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46e18*, lpNumberOfBytesWritten=0x19ecac*=0x60, lpOverlapped=0x0) returned 1 [0062.864] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0062.880] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0062.884] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.891] CloseHandle (hObject=0x190) returned 1 [0062.891] CloseHandle (hObject=0x198) returned 1 [0062.892] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.893] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0062.893] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0062.893] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0062.893] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0062.893] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx")) returned 1 [0062.894] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\0000000000000000.idx")) returned 0xffffffff [0062.894] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.894] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0062.895] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.895] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.895] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0062.896] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0062.896] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0062.896] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0062.897] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0062.908] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0062.957] ReadFile (in: hFile=0x190, lpBuffer=0x1d47014, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ea44*=0xe9, lpOverlapped=0x0) returned 1 [0062.958] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ea44*=0xf0, lpOverlapped=0x0) returned 1 [0062.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0062.974] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0062.979] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0062.986] CloseHandle (hObject=0x190) returned 1 [0062.986] CloseHandle (hObject=0x19c) returned 1 [0062.987] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0062.987] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0062.987] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0062.987] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0062.987] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0062.987] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat")) returned 1 [0062.988] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\61\\EFAE1E6619D4EE51.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\61\\efae1e6619d4ee51.dat")) returned 0xffffffff [0062.988] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0062.989] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0062.989] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0062.989] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.989] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0062.989] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0062.989] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0062.990] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c0 [0062.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0062.990] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0062.998] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0063.111] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47024, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47024*, lpNumberOfBytesRead=0x19ea44*=0x1c0, lpOverlapped=0x0) returned 1 [0063.112] WriteFile (in: hFile=0x190, lpBuffer=0x1d47024*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47024*, lpNumberOfBytesWritten=0x19ea44*=0x1d0, lpOverlapped=0x0) returned 1 [0063.113] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0063.128] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0063.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.139] CloseHandle (hObject=0x19c) returned 1 [0063.140] CloseHandle (hObject=0x190) returned 1 [0063.140] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0063.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0063.141] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0063.141] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0063.141] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0063.141] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat")) returned 1 [0063.142] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\90\\B6D0EAFA5E8634A6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\90\\b6d0eafa5e8634a6.dat")) returned 0xffffffff [0063.142] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0063.142] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0063.143] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0063.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535340 [0063.143] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0063.143] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0063.143] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0063.144] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0063.144] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x166 [0063.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0063.144] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0063.153] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0063.197] ReadFile (in: hFile=0x190, lpBuffer=0x1d47034, nNumberOfBytesToRead=0x166, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47034*, lpNumberOfBytesRead=0x19ea44*=0x166, lpOverlapped=0x0) returned 1 [0063.198] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47034*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47034*, lpNumberOfBytesWritten=0x19ea44*=0x170, lpOverlapped=0x0) returned 1 [0063.199] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0063.215] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0063.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.225] CloseHandle (hObject=0x190) returned 1 [0063.225] CloseHandle (hObject=0x19c) returned 1 [0063.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0063.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0063.230] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0063.230] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0063.231] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0063.231] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 1 [0063.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\2\\94\\A75BFDE52F3DD8E6.dat" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\2\\94\\a75bfde52f3dd8e6.dat")) returned 0xffffffff [0063.232] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0063.232] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0063.232] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0063.232] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0063.232] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0063.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0063.232] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0063.232] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0063.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0063.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0063.233] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0063.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0063.233] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0063.240] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0063.295] ReadFile (in: hFile=0x198, lpBuffer=0x1d46ee4, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ee4*, lpNumberOfBytesRead=0x19ecac*=0x50, lpOverlapped=0x0) returned 1 [0063.295] WriteFile (in: hFile=0x19c, lpBuffer=0x1d46ee4*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ee4*, lpNumberOfBytesWritten=0x19ecac*=0x60, lpOverlapped=0x0) returned 1 [0063.296] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0063.311] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0063.315] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.322] CloseHandle (hObject=0x198) returned 1 [0063.323] CloseHandle (hObject=0x19c) returned 1 [0063.323] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0063.324] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0063.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0063.324] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0063.324] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0063.324] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx")) returned 1 [0063.325] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\3\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\3\\0000000000000000.idx")) returned 0xffffffff [0063.326] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0063.326] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0063.326] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0063.326] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0063.327] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0063.327] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0063.327] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0063.329] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0063.330] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0063.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0063.330] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0063.337] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0063.381] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47058, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesRead=0x19ecac*=0x50, lpOverlapped=0x0) returned 1 [0063.381] WriteFile (in: hFile=0x198, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ecac*=0x60, lpOverlapped=0x0) returned 1 [0063.382] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0063.398] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0063.402] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0063.408] CloseHandle (hObject=0x19c) returned 1 [0063.408] CloseHandle (hObject=0x198) returned 1 [0063.409] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0063.410] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0063.410] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0063.410] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0063.410] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0063.410] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx")) returned 1 [0063.411] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MetaStore\\4\\0000000000000000.idx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\metastore\\4\\0000000000000000.idx")) returned 0xffffffff [0063.411] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0063.411] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0063.412] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0063.412] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0063.412] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0063.412] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0063.413] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0063.413] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa36067 [0063.413] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0063.414] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0063.421] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0063.483] ReadFile (in: hFile=0x18c, lpBuffer=0x1d4703c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesRead=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0064.200] WriteFile (in: hFile=0x194, lpBuffer=0x1d4703c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesWritten=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0064.291] ReadFile (in: hFile=0x18c, lpBuffer=0x1d4703c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesRead=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0064.397] WriteFile (in: hFile=0x194, lpBuffer=0x1d4703c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesWritten=0x19f17c*=0x500000, lpOverlapped=0x0) returned 1 [0064.469] ReadFile (in: hFile=0x18c, lpBuffer=0x1d4703c, nNumberOfBytesToRead=0x36067, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesRead=0x19f17c*=0x36067, lpOverlapped=0x0) returned 1 [0064.479] WriteFile (in: hFile=0x194, lpBuffer=0x1d4703c*, nNumberOfBytesToWrite=0x36070, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesWritten=0x19f17c*=0x36070, lpOverlapped=0x0) returned 1 [0064.484] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0064.499] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0064.503] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.510] CloseHandle (hObject=0x18c) returned 1 [0064.510] CloseHandle (hObject=0x194) returned 1 [0064.717] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0064.717] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0064.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535080 [0064.718] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0064.718] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0064.718] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin")) returned 1 [0064.720] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\mpcache-A14CDE2848BB5D8B88DFAFE00552ABFC83C353CE.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpcache-a14cde2848bb5d8b88dfafe00552abfc83c353ce.bin")) returned 0xffffffff [0064.720] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.721] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.721] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.722] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.723] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.723] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.724] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.724] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.725] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.726] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.726] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.726] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0064.727] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0064.728] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70 [0064.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0064.729] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0064.735] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0064.777] ReadFile (in: hFile=0x194, lpBuffer=0x1d47018, nNumberOfBytesToRead=0x70, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d47018*, lpNumberOfBytesRead=0x19f17c*=0x70, lpOverlapped=0x0) returned 1 [0064.777] WriteFile (in: hFile=0x18c, lpBuffer=0x1d47018*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d47018*, lpNumberOfBytesWritten=0x19f17c*=0x80, lpOverlapped=0x0) returned 1 [0064.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0064.793] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0064.797] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.804] CloseHandle (hObject=0x194) returned 1 [0064.804] CloseHandle (hObject=0x18c) returned 1 [0064.805] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0064.805] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0064.805] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x5351c0 [0064.806] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0064.806] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0064.806] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin")) returned 1 [0064.807] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\MpDiag.bin" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\scans\\mpdiag.bin")) returned 0xffffffff [0064.807] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.808] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0064.808] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.808] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\RtSigs\\Data\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0064.808] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0064.808] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.808] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0064.808] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0064.808] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535080 [0064.808] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0064.808] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0064.808] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0064.809] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0064.809] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0064.809] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535180 [0064.809] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0064.809] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0064.810] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0064.810] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0064.810] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1231 [0064.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0064.811] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0064.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0064.860] ReadFile (in: hFile=0x188, lpBuffer=0x1d45338, nNumberOfBytesToRead=0x1231, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d45338*, lpNumberOfBytesRead=0x19f3e4*=0x1231, lpOverlapped=0x0) returned 1 [0064.871] WriteFile (in: hFile=0x18c, lpBuffer=0x1d45338*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d45338*, lpNumberOfBytesWritten=0x19f3e4*=0x1240, lpOverlapped=0x0) returned 1 [0064.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0064.886] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0064.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0064.896] CloseHandle (hObject=0x188) returned 1 [0064.896] CloseHandle (hObject=0x18c) returned 1 [0064.897] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0064.898] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0064.898] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535000 [0064.898] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0064.898] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0064.898] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png")) returned 1 [0064.899] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Live\\WLive48x48.png" (normalized: "c:\\users\\all users\\microsoft\\windows live\\wlive48x48.png")) returned 0xffffffff [0064.899] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0064.900] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0064.900] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0064.900] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535240 [0064.900] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0064.900] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0064.900] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0064.901] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.901] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.901] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534ec0 [0064.901] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.901] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.902] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0064.902] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0064.902] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.902] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0064.902] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.902] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.903] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.903] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.903] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.904] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0064.904] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0064.904] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.904] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0064.904] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.904] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0064.904] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.904] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.904] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0064.904] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.904] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0064.904] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.904] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.904] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0064.905] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.905] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534dc0 [0064.905] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.905] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.905] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0064.905] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.905] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534ec0 [0064.905] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.905] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0064.905] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0064.906] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.906] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0064.906] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0064.906] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0064.906] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0064.906] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0064.906] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0064.906] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0064.906] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0064.906] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0064.906] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.906] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0064.907] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0064.907] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0064.907] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e148 [0064.907] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0064.908] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0064.914] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0064.958] ReadFile (in: hFile=0x188, lpBuffer=0x1d45640, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d45640*, lpNumberOfBytesRead=0x19f17c*=0x7e148, lpOverlapped=0x0) returned 1 [0065.139] WriteFile (in: hFile=0x194, lpBuffer=0x1d45640*, nNumberOfBytesToWrite=0x7e150, lpNumberOfBytesWritten=0x19f17c, lpOverlapped=0x0 | out: lpBuffer=0x1d45640*, lpNumberOfBytesWritten=0x19f17c*=0x7e150, lpOverlapped=0x0) returned 1 [0065.145] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0065.161] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0065.164] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.178] CloseHandle (hObject=0x188) returned 1 [0065.178] CloseHandle (hObject=0x194) returned 1 [0065.186] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0065.186] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0065.186] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534ec0 [0065.187] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0 [0065.187] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0065.187] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0 [0065.187] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0065.187] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.187] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0065.187] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0065.187] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0065.188] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.188] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534dc0 [0065.201] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.201] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.201] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WinMSIPC\\Server\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0065.201] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.201] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.201] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0065.201] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0065.201] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.202] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534e40 [0065.202] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.202] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\DMProfiles\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0065.202] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.202] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.202] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0065.202] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.202] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0065.202] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0065.202] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0065.202] FindClose (in: hFindFile=0x534e00 | out: hFindFile=0x534e00) returned 1 [0065.203] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0065.203] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534f40 [0065.203] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.203] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.203] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535300 [0065.203] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.203] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.203] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0065.203] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0065.204] GetFileSize (in: hFile=0x18c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19 [0065.204] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0065.204] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0065.211] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0065.269] ReadFile (in: hFile=0x18c, lpBuffer=0x1d458f8, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d458f8*, lpNumberOfBytesRead=0x19f3e4*=0x19, lpOverlapped=0x0) returned 1 [0065.270] WriteFile (in: hFile=0x194, lpBuffer=0x1d458f8*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d458f8*, lpNumberOfBytesWritten=0x19f3e4*=0x20, lpOverlapped=0x0) returned 1 [0065.270] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0065.286] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0065.290] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.313] CloseHandle (hObject=0x18c) returned 1 [0065.313] CloseHandle (hObject=0x194) returned 1 [0065.316] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0065.317] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0065.317] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x5351c0 [0065.317] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0065.317] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0065.317] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 1 [0065.318] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\refcount.ini" (normalized: "c:\\users\\all users\\microsoft onedrive\\setup\\refcount.ini")) returned 0xffffffff [0065.318] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0065.318] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0065.318] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0065.319] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0065.319] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0065.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x535180 [0065.319] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.319] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535300 [0065.319] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.319] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.319] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\.oracle_jre_usage\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5351c0 [0065.320] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.320] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.320] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.320] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0065.320] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.320] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\installcache_x64\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534d00 [0065.320] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.320] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.321] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.321] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0065.321] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.321] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535340 [0065.321] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.321] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.321] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.322] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.322] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.322] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0065.323] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Oracle\\Java\\javapath_target_5923062\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0065.323] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.323] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.323] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.323] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.324] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0065.324] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0065.324] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0065.324] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0065.324] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0065.324] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0065.324] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0065.324] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534e80 [0065.513] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.545] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0065.545] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535240 [0065.546] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.547] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0065.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0065.547] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.547] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0065.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535400 [0065.547] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0065.547] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0065.547] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0065.548] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0065.623] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf36be [0065.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0065.623] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0065.630] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0065.676] ReadFile (in: hFile=0x188, lpBuffer=0x1d4675c, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4675c*, lpNumberOfBytesRead=0x19ef14*=0xf36be, lpOverlapped=0x0) returned 1 [0065.789] WriteFile (in: hFile=0x198, lpBuffer=0x1d4675c*, nNumberOfBytesToWrite=0xf36c0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4675c*, lpNumberOfBytesWritten=0x19ef14*=0xf36c0, lpOverlapped=0x0) returned 1 [0065.801] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0065.817] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0065.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0065.828] CloseHandle (hObject=0x188) returned 1 [0065.828] CloseHandle (hObject=0x198) returned 1 [0065.842] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0065.843] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0065.843] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535380 [0065.843] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0065.843] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0065.843] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0065.851] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0065.851] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0065.851] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0065.852] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0065.853] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0065.853] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0065.854] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0065.860] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0065.910] ReadFile (in: hFile=0x198, lpBuffer=0x1d46930, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46930*, lpNumberOfBytesRead=0x19ef14*=0x23000, lpOverlapped=0x0) returned 1 [0065.997] WriteFile (in: hFile=0x188, lpBuffer=0x1d46930*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46930*, lpNumberOfBytesWritten=0x19ef14*=0x23010, lpOverlapped=0x0) returned 1 [0065.999] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0066.015] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0066.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.025] CloseHandle (hObject=0x198) returned 1 [0066.025] CloseHandle (hObject=0x188) returned 1 [0066.028] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0066.028] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0066.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e00 [0066.029] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0066.029] FindClose (in: hFindFile=0x534e00 | out: hFindFile=0x534e00) returned 1 [0066.029] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0066.030] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0066.030] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0066.030] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0066.031] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0066.031] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0066.031] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0066.031] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0066.031] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0066.031] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535300 [0066.031] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0066.031] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0066.031] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0066.032] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0066.032] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0066.032] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0066.032] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534dc0 [0066.032] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0066.032] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0066.032] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e00 [0066.032] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0066.032] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0066.032] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0066.032] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0066.032] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0066.032] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0066.034] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0066.104] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x588124 [0066.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0066.104] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0066.111] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0066.179] ReadFile (in: hFile=0x188, lpBuffer=0x1d46e94, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e94*, lpNumberOfBytesRead=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0066.602] WriteFile (in: hFile=0x198, lpBuffer=0x1d46e94*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e94*, lpNumberOfBytesWritten=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0066.780] ReadFile (in: hFile=0x188, lpBuffer=0x1d46e94, nNumberOfBytesToRead=0x88124, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e94*, lpNumberOfBytesRead=0x19ef14*=0x88124, lpOverlapped=0x0) returned 1 [0066.812] WriteFile (in: hFile=0x198, lpBuffer=0x1d46e94*, nNumberOfBytesToWrite=0x88130, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e94*, lpNumberOfBytesWritten=0x19ef14*=0x88130, lpOverlapped=0x0) returned 1 [0066.823] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0066.898] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0066.903] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0066.910] CloseHandle (hObject=0x188) returned 1 [0066.910] CloseHandle (hObject=0x198) returned 1 [0067.032] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0067.032] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0067.032] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0067.033] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0067.033] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0067.033] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0067.038] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0067.038] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0067.038] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0067.038] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0067.039] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0067.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0067.039] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0067.046] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0067.159] ReadFile (in: hFile=0x198, lpBuffer=0x1d46f30, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f30*, lpNumberOfBytesRead=0x19ef14*=0x25000, lpOverlapped=0x0) returned 1 [0067.165] WriteFile (in: hFile=0x188, lpBuffer=0x1d46f30*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f30*, lpNumberOfBytesWritten=0x19ef14*=0x25010, lpOverlapped=0x0) returned 1 [0067.167] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0067.186] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0067.189] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.199] CloseHandle (hObject=0x198) returned 1 [0067.199] CloseHandle (hObject=0x188) returned 1 [0067.203] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0067.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0067.204] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e40 [0067.205] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0067.205] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0067.205] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0067.207] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0067.207] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0067.207] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0067.208] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0067.208] FindClose (in: hFindFile=0x534e00 | out: hFindFile=0x534e00) returned 1 [0067.208] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0067.208] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0067.208] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0067.208] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534e40 [0067.210] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.210] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.211] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.211] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0067.211] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0067.212] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0067.212] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535400 [0067.212] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.212] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.213] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.213] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0067.213] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0067.214] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0067.214] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535040 [0067.215] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.215] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.215] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0067.216] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0067.216] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0067.216] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0067.216] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0067.216] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0067.216] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0067.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0067.219] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x165257 [0067.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0067.219] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0067.227] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0067.272] ReadFile (in: hFile=0x188, lpBuffer=0x1d46f7c, nNumberOfBytesToRead=0x165257, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f7c*, lpNumberOfBytesRead=0x19ef14*=0x165257, lpOverlapped=0x0) returned 1 [0067.329] WriteFile (in: hFile=0x198, lpBuffer=0x1d46f7c*, nNumberOfBytesToWrite=0x165260, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46f7c*, lpNumberOfBytesWritten=0x19ef14*=0x165260, lpOverlapped=0x0) returned 1 [0067.354] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0067.372] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0067.375] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.383] CloseHandle (hObject=0x188) returned 1 [0067.383] CloseHandle (hObject=0x198) returned 1 [0067.414] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0067.414] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0067.415] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534d00 [0067.415] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0067.415] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0067.415] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0067.418] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0067.419] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0067.419] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0067.422] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0067.423] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24000 [0067.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0067.423] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0067.430] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0067.475] ReadFile (in: hFile=0x198, lpBuffer=0x1d47050, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47050*, lpNumberOfBytesRead=0x19ef14*=0x24000, lpOverlapped=0x0) returned 1 [0067.513] WriteFile (in: hFile=0x188, lpBuffer=0x1d47050*, nNumberOfBytesToWrite=0x24010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47050*, lpNumberOfBytesWritten=0x19ef14*=0x24010, lpOverlapped=0x0) returned 1 [0067.515] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0067.531] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0067.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.541] CloseHandle (hObject=0x198) returned 1 [0067.541] CloseHandle (hObject=0x188) returned 1 [0067.544] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0067.545] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0067.545] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535340 [0067.545] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0067.545] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0067.545] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0067.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0067.547] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0067.547] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0067.547] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0067.547] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0067.547] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0067.547] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0067.547] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0067.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534f40 [0067.551] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.551] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0067.551] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0067.551] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0067.551] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0067.551] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0067.551] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0067.551] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0067.551] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0067.552] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0067.592] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554520 [0067.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0067.593] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0067.599] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0067.646] ReadFile (in: hFile=0x188, lpBuffer=0x1d4705c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesRead=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0067.841] WriteFile (in: hFile=0x198, lpBuffer=0x1d4705c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesWritten=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0067.911] ReadFile (in: hFile=0x188, lpBuffer=0x1d4705c, nNumberOfBytesToRead=0x54520, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesRead=0x19ef14*=0x54520, lpOverlapped=0x0) returned 1 [0067.922] WriteFile (in: hFile=0x198, lpBuffer=0x1d4705c*, nNumberOfBytesToWrite=0x54530, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesWritten=0x19ef14*=0x54530, lpOverlapped=0x0) returned 1 [0067.928] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0067.944] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0067.948] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0067.954] CloseHandle (hObject=0x188) returned 1 [0067.954] CloseHandle (hObject=0x198) returned 1 [0068.066] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0068.066] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0068.066] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0068.067] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0068.067] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0068.067] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0068.068] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0068.068] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0068.068] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0068.085] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0068.085] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0068.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0068.086] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0068.142] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0068.191] ReadFile (in: hFile=0x198, lpBuffer=0x1d4705c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesRead=0x19ef14*=0x23000, lpOverlapped=0x0) returned 1 [0068.395] WriteFile (in: hFile=0x188, lpBuffer=0x1d4705c*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesWritten=0x19ef14*=0x23010, lpOverlapped=0x0) returned 1 [0068.408] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0068.424] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0068.428] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.435] CloseHandle (hObject=0x198) returned 1 [0068.435] CloseHandle (hObject=0x188) returned 1 [0068.438] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0068.438] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0068.438] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5353c0 [0068.439] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0068.439] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0068.439] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0068.440] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0068.440] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0068.440] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0068.441] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0068.441] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0068.441] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0068.441] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0068.441] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0068.441] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535040 [0068.442] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0068.442] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0068.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0068.442] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0068.442] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0068.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535340 [0068.442] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0068.442] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0068.443] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0068.443] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0068.488] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x135350 [0068.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0068.488] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0068.498] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0068.547] ReadFile (in: hFile=0x188, lpBuffer=0x1d4703c, nNumberOfBytesToRead=0x135350, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesRead=0x19ef14*=0x135350, lpOverlapped=0x0) returned 1 [0068.632] WriteFile (in: hFile=0x198, lpBuffer=0x1d4703c*, nNumberOfBytesToWrite=0x135360, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesWritten=0x19ef14*=0x135360, lpOverlapped=0x0) returned 1 [0068.652] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0068.673] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0068.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.684] CloseHandle (hObject=0x188) returned 1 [0068.685] CloseHandle (hObject=0x198) returned 1 [0068.717] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0068.718] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0068.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0068.718] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0068.718] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0068.718] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0068.720] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0068.720] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0068.720] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0068.721] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0068.722] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24000 [0068.722] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0068.722] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0068.729] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0068.750] ReadFile (in: hFile=0x198, lpBuffer=0x1d4703c, nNumberOfBytesToRead=0x24000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesRead=0x19ef14*=0x24000, lpOverlapped=0x0) returned 1 [0068.776] WriteFile (in: hFile=0x188, lpBuffer=0x1d4703c*, nNumberOfBytesToWrite=0x24010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4703c*, lpNumberOfBytesWritten=0x19ef14*=0x24010, lpOverlapped=0x0) returned 1 [0068.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0068.794] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0068.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.806] CloseHandle (hObject=0x198) returned 1 [0068.806] CloseHandle (hObject=0x188) returned 1 [0068.808] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0068.809] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0068.809] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535300 [0068.809] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0068.809] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0068.809] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0068.811] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}v14.0.23026\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{a2563e55-3bec-3828-8d67-e5e8b9e8b675}v14.0.23026\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0068.811] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0068.811] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0068.811] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0068.811] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0068.811] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0068.811] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0068.811] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0068.811] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535400 [0068.811] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0068.811] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0068.811] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534e40 [0068.812] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0068.812] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0068.812] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0068.812] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0068.812] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0068.812] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0068.812] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0068.837] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc90a [0068.837] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0068.837] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0068.844] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0068.863] ReadFile (in: hFile=0x188, lpBuffer=0x1d46e3c, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e3c*, lpNumberOfBytesRead=0x19ef14*=0xfc90a, lpOverlapped=0x0) returned 1 [0068.941] WriteFile (in: hFile=0x198, lpBuffer=0x1d46e3c*, nNumberOfBytesToWrite=0xfc910, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e3c*, lpNumberOfBytesWritten=0x19ef14*=0xfc910, lpOverlapped=0x0) returned 1 [0068.953] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0068.969] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0068.976] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0068.983] CloseHandle (hObject=0x188) returned 1 [0068.983] CloseHandle (hObject=0x198) returned 1 [0068.997] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0068.998] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0068.998] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535380 [0068.998] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0068.998] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0068.998] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0069.005] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0069.005] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.005] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0069.016] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.017] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0069.017] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0069.017] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0069.028] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0069.045] ReadFile (in: hFile=0x198, lpBuffer=0x1d47004, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47004*, lpNumberOfBytesRead=0x19ef14*=0x23000, lpOverlapped=0x0) returned 1 [0069.059] WriteFile (in: hFile=0x188, lpBuffer=0x1d47004*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47004*, lpNumberOfBytesWritten=0x19ef14*=0x23010, lpOverlapped=0x0) returned 1 [0069.061] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0069.076] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0069.080] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.111] CloseHandle (hObject=0x198) returned 1 [0069.111] CloseHandle (hObject=0x188) returned 1 [0069.114] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0069.114] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0069.114] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5353c0 [0069.114] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0069.114] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0069.115] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0069.116] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0069.116] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0069.116] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0069.116] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0069.116] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0069.116] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0069.116] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0069.117] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0069.117] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534ec0 [0069.118] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0069.118] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0069.118] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0069.119] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0069.119] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0069.119] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0069.119] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.119] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.119] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.119] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0069.126] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ea418 [0069.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0069.126] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0069.133] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0069.151] ReadFile (in: hFile=0x188, lpBuffer=0x1d46fec, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46fec*, lpNumberOfBytesRead=0x19ef14*=0x4ea418, lpOverlapped=0x0) returned 1 [0069.313] WriteFile (in: hFile=0x198, lpBuffer=0x1d46fec*, nNumberOfBytesToWrite=0x4ea420, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46fec*, lpNumberOfBytesWritten=0x19ef14*=0x4ea420, lpOverlapped=0x0) returned 1 [0069.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0069.423] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0069.427] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.434] CloseHandle (hObject=0x188) returned 1 [0069.435] CloseHandle (hObject=0x198) returned 1 [0069.530] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0069.530] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0069.530] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534c80 [0069.531] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0069.531] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0069.531] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0069.538] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0069.538] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.538] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0069.539] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.540] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0069.540] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0069.540] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0069.547] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0069.569] ReadFile (in: hFile=0x198, lpBuffer=0x1d4701c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesRead=0x19ef14*=0x25000, lpOverlapped=0x0) returned 1 [0069.573] WriteFile (in: hFile=0x188, lpBuffer=0x1d4701c*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesWritten=0x19ef14*=0x25010, lpOverlapped=0x0) returned 1 [0069.575] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0069.591] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0069.594] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.601] CloseHandle (hObject=0x198) returned 1 [0069.602] CloseHandle (hObject=0x188) returned 1 [0069.604] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0069.605] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0069.605] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534f40 [0069.605] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0069.605] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0069.605] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0069.607] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0069.607] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0069.607] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0069.607] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0069.607] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0069.607] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0069.607] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0069.607] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0069.607] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535300 [0069.608] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0069.608] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0069.608] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534dc0 [0069.608] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0069.608] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0069.608] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0069.608] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.608] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.608] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0069.623] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc89b1 [0069.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0069.624] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0069.631] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0069.648] ReadFile (in: hFile=0x188, lpBuffer=0x1d47044, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesRead=0x19ef14*=0xc89b1, lpOverlapped=0x0) returned 1 [0069.672] WriteFile (in: hFile=0x198, lpBuffer=0x1d47044*, nNumberOfBytesToWrite=0xc89c0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesWritten=0x19ef14*=0xc89c0, lpOverlapped=0x0) returned 1 [0069.685] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0069.700] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0069.705] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.712] CloseHandle (hObject=0x188) returned 1 [0069.712] CloseHandle (hObject=0x198) returned 1 [0069.724] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0069.725] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0069.725] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534ec0 [0069.725] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0069.725] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0069.727] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0069.735] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0069.735] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.735] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0069.736] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.736] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0069.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0069.737] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0069.745] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0069.770] ReadFile (in: hFile=0x198, lpBuffer=0x1d47044, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesRead=0x19ef14*=0x25000, lpOverlapped=0x0) returned 1 [0069.788] WriteFile (in: hFile=0x188, lpBuffer=0x1d47044*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47044*, lpNumberOfBytesWritten=0x19ef14*=0x25010, lpOverlapped=0x0) returned 1 [0069.790] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0069.806] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0069.811] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0069.819] CloseHandle (hObject=0x198) returned 1 [0069.819] CloseHandle (hObject=0x188) returned 1 [0069.822] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0069.822] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0069.822] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535340 [0069.822] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0069.823] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0069.823] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0069.824] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0069.825] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0069.825] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0069.825] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0069.825] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0069.825] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0069.825] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0069.825] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0069.825] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534cc0 [0069.825] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0069.825] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0069.825] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535240 [0069.825] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0069.826] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0069.826] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0069.827] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.827] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0069.827] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0069.828] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0069.848] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c1f72 [0069.848] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0069.848] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0069.858] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0069.906] ReadFile (in: hFile=0x188, lpBuffer=0x1d46d14, nNumberOfBytesToRead=0x4c1f72, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46d14*, lpNumberOfBytesRead=0x19ef14*=0x4c1f72, lpOverlapped=0x0) returned 1 [0070.148] WriteFile (in: hFile=0x198, lpBuffer=0x1d46d14*, nNumberOfBytesToWrite=0x4c1f80, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46d14*, lpNumberOfBytesWritten=0x19ef14*=0x4c1f80, lpOverlapped=0x0) returned 1 [0070.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0070.228] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0070.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.238] CloseHandle (hObject=0x188) returned 1 [0070.238] CloseHandle (hObject=0x198) returned 1 [0070.330] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0070.331] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0070.331] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535400 [0070.331] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0070.331] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0070.331] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0070.337] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0070.337] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0070.337] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0070.338] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0070.338] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0070.338] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0070.338] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0070.345] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0070.391] ReadFile (in: hFile=0x198, lpBuffer=0x1d46e74, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e74*, lpNumberOfBytesRead=0x19ef14*=0x23000, lpOverlapped=0x0) returned 1 [0070.408] WriteFile (in: hFile=0x188, lpBuffer=0x1d46e74*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46e74*, lpNumberOfBytesWritten=0x19ef14*=0x23010, lpOverlapped=0x0) returned 1 [0070.410] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0070.426] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0070.430] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.436] CloseHandle (hObject=0x198) returned 1 [0070.436] CloseHandle (hObject=0x188) returned 1 [0070.439] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0070.440] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0070.440] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534c80 [0070.440] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0070.440] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0070.440] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0070.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}v14.0.23026\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{be960c1c-7bad-3de6-8b1a-2616fe532845}v14.0.23026\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0070.442] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0070.442] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0070.442] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0070.442] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0070.442] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0070.442] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0070.442] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0070.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534c80 [0070.443] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.443] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.443] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.444] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0070.444] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0070.444] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0070.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x5351c0 [0070.444] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.444] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x5353c0 [0070.444] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0070.444] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0070.444] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0070.444] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0070.444] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0070.444] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0070.444] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0070.466] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5b25 [0070.466] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0070.466] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0070.473] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0070.516] ReadFile (in: hFile=0x188, lpBuffer=0x1d47064, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47064*, lpNumberOfBytesRead=0x19ef14*=0xc5b25, lpOverlapped=0x0) returned 1 [0070.553] WriteFile (in: hFile=0x198, lpBuffer=0x1d47064*, nNumberOfBytesToWrite=0xc5b30, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47064*, lpNumberOfBytesWritten=0x19ef14*=0xc5b30, lpOverlapped=0x0) returned 1 [0070.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0070.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0070.581] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.590] CloseHandle (hObject=0x188) returned 1 [0070.590] CloseHandle (hObject=0x198) returned 1 [0070.601] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0070.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0070.602] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e00 [0070.602] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0070.602] FindClose (in: hFindFile=0x534e00 | out: hFindFile=0x534e00) returned 1 [0070.602] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0070.609] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0070.609] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0070.609] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0070.609] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0070.610] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0070.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0070.610] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0070.617] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0070.658] ReadFile (in: hFile=0x198, lpBuffer=0x1d47064, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47064*, lpNumberOfBytesRead=0x19ef14*=0x25000, lpOverlapped=0x0) returned 1 [0070.662] WriteFile (in: hFile=0x188, lpBuffer=0x1d47064*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47064*, lpNumberOfBytesWritten=0x19ef14*=0x25010, lpOverlapped=0x0) returned 1 [0070.664] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0070.679] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0070.683] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0070.689] CloseHandle (hObject=0x198) returned 1 [0070.690] CloseHandle (hObject=0x188) returned 1 [0070.692] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0070.693] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0070.693] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e40 [0070.693] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0070.693] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0070.693] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0070.695] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0070.695] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0070.695] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0070.695] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0070.695] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0070.695] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0070.695] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0070.695] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0070.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535180 [0070.695] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.695] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0070.695] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0070.698] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0070.698] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0070.698] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535340 [0070.698] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0070.698] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0070.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0070.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0070.718] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59bde5 [0070.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0070.718] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0070.725] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0070.766] ReadFile (in: hFile=0x188, lpBuffer=0x1d4705c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesRead=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0070.988] WriteFile (in: hFile=0x198, lpBuffer=0x1d4705c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesWritten=0x19ef14*=0x500000, lpOverlapped=0x0) returned 1 [0071.054] ReadFile (in: hFile=0x188, lpBuffer=0x1d4705c, nNumberOfBytesToRead=0x9bde5, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesRead=0x19ef14*=0x9bde5, lpOverlapped=0x0) returned 1 [0071.068] WriteFile (in: hFile=0x198, lpBuffer=0x1d4705c*, nNumberOfBytesToWrite=0x9bdf0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4705c*, lpNumberOfBytesWritten=0x19ef14*=0x9bdf0, lpOverlapped=0x0) returned 1 [0071.078] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0071.162] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0071.167] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.174] CloseHandle (hObject=0x188) returned 1 [0071.174] CloseHandle (hObject=0x198) returned 1 [0071.285] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0071.286] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0071.286] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0071.286] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0071.286] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0071.286] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0071.291] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0071.291] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0071.291] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0071.291] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0071.292] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0071.292] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0071.292] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0071.299] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0071.344] ReadFile (in: hFile=0x198, lpBuffer=0x1d4702c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4702c*, lpNumberOfBytesRead=0x19ef14*=0x23000, lpOverlapped=0x0) returned 1 [0071.369] WriteFile (in: hFile=0x188, lpBuffer=0x1d4702c*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4702c*, lpNumberOfBytesWritten=0x19ef14*=0x23010, lpOverlapped=0x0) returned 1 [0071.371] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0071.387] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0071.391] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.397] CloseHandle (hObject=0x198) returned 1 [0071.397] CloseHandle (hObject=0x188) returned 1 [0071.400] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0071.401] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0071.401] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0071.401] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0071.401] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0071.401] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0071.403] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0071.403] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0071.403] FindClose (in: hFindFile=0x535340 | out: hFindFile=0x535340) returned 1 [0071.403] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0071.403] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0071.403] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0071.403] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0071.403] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.403] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534dc0 [0071.403] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.403] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.404] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.404] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0071.404] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0071.404] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.404] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x535240 [0071.405] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.405] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.405] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.405] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0071.405] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0071.405] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534f40 [0071.406] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.406] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0071.406] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0071.406] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0071.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0071.407] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0071.407] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0071.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0071.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0071.417] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b4520 [0071.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0071.418] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0071.424] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0071.466] ReadFile (in: hFile=0x188, lpBuffer=0x1d46ef8, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ef8*, lpNumberOfBytesRead=0x19ef14*=0x4b4520, lpOverlapped=0x0) returned 1 [0071.688] WriteFile (in: hFile=0x198, lpBuffer=0x1d46ef8*, nNumberOfBytesToWrite=0x4b4530, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d46ef8*, lpNumberOfBytesWritten=0x19ef14*=0x4b4530, lpOverlapped=0x0) returned 1 [0071.755] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0071.770] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0071.774] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.780] CloseHandle (hObject=0x188) returned 1 [0071.780] CloseHandle (hObject=0x198) returned 1 [0071.872] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0071.873] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0071.873] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534dc0 [0071.873] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0071.873] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0071.873] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0071.878] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0071.878] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0071.879] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0071.881] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0071.882] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0071.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0071.882] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0071.889] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0071.934] ReadFile (in: hFile=0x198, lpBuffer=0x1d47058, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesRead=0x19ef14*=0x23000, lpOverlapped=0x0) returned 1 [0071.950] WriteFile (in: hFile=0x188, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ef14*=0x23010, lpOverlapped=0x0) returned 1 [0071.953] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0071.968] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0071.972] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0071.978] CloseHandle (hObject=0x198) returned 1 [0071.979] CloseHandle (hObject=0x188) returned 1 [0071.981] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0071.982] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0071.982] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534dc0 [0071.982] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0071.982] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0071.982] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0071.984] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0071.984] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0071.984] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0071.984] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0071.984] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0071.984] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0071.984] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0071.984] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0071.984] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0071.984] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0071.984] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534dc0 [0071.989] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.989] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.990] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.991] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.991] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.992] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0071.992] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0071.993] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0071.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\SoftwareDistribution\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x535000 [0071.993] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.993] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0071.993] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0071.993] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0071.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0xffffffff [0071.993] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0071.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0xffffffff [0071.993] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0071.993] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534f40 [0071.994] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.994] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.994] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534dc0 [0071.994] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.994] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.994] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0071.994] FindClose (in: hFindFile=0x534dc0 | out: hFindFile=0x534dc0) returned 1 [0071.994] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0071.994] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0071.994] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0071.994] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOShared\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x535000 [0071.995] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.995] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0071.995] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534d00 [0071.995] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.995] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.995] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.996] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.996] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.997] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.997] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.998] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.998] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.999] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0071.999] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.000] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.000] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.000] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.001] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.001] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.002] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.002] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.003] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.003] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.004] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.004] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.005] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.005] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0 [0072.005] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0072.005] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0 [0072.005] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0072.006] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 0 [0072.006] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0072.006] FindNextFileA (in: hFindFile=0x535140, lpFindFileData=0x19fda4 | out: lpFindFileData=0x19fda4) returned 1 [0072.006] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 0x535340 [0072.006] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0072.006] FindNextFileA (in: hFindFile=0x535340, lpFindFileData=0x19fb3c | out: lpFindFileData=0x19fb3c) returned 1 [0072.006] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 0x534e00 [0072.006] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0072.006] FindNextFileA (in: hFindFile=0x534e00, lpFindFileData=0x19f8d4 | out: lpFindFileData=0x19f8d4) returned 1 [0072.006] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\*.*", lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 0x534dc0 [0072.006] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.006] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.006] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535300 [0072.006] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.006] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.006] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535040 [0072.009] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.009] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.009] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0072.020] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.020] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.020] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.020] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.021] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.021] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.021] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\Cache\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0072.022] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.022] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.023] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.023] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0072.023] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0072.024] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.024] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0072.026] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.026] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd146 [0072.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.026] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.033] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.076] ReadFile (in: hFile=0x198, lpBuffer=0x1d47008, nNumberOfBytesToRead=0xd146, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ecac*=0xd146, lpOverlapped=0x0) returned 1 [0072.086] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0xd150, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ecac*=0xd150, lpOverlapped=0x0) returned 1 [0072.088] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.109] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.112] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.178] CloseHandle (hObject=0x198) returned 1 [0072.178] CloseHandle (hObject=0x19c) returned 1 [0072.179] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.180] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.180] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0072.180] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0072.180] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0072.180] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 1 [0072.181] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr.dat")) returned 0xffffffff [0072.181] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.182] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.182] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0072.182] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2da43 [0072.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.182] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.189] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.257] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47018, nNumberOfBytesToRead=0x2da43, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47018*, lpNumberOfBytesRead=0x19ecac*=0x2da43, lpOverlapped=0x0) returned 1 [0072.301] WriteFile (in: hFile=0x198, lpBuffer=0x1d47018*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47018*, lpNumberOfBytesWritten=0x19ecac*=0x2da50, lpOverlapped=0x0) returned 1 [0072.305] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.324] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.328] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.334] CloseHandle (hObject=0x19c) returned 1 [0072.335] CloseHandle (hObject=0x198) returned 1 [0072.344] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.344] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.344] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0072.344] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0072.344] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0072.344] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 1 [0072.346] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\iconcacherdr65536.dat")) returned 0xffffffff [0072.346] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.347] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.347] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\ToolsSearchCacheRdr\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f00 [0072.347] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.347] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0072.347] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0072.347] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.347] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0072.350] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.350] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7b5 [0072.350] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.351] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.358] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.403] ReadFile (in: hFile=0x198, lpBuffer=0x1d46ff4, nNumberOfBytesToRead=0xf7b5, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ff4*, lpNumberOfBytesRead=0x19ecac*=0xf7b5, lpOverlapped=0x0) returned 1 [0072.414] WriteFile (in: hFile=0x19c, lpBuffer=0x1d46ff4*, nNumberOfBytesToWrite=0xf7c0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d46ff4*, lpNumberOfBytesWritten=0x19ecac*=0xf7c0, lpOverlapped=0x0) returned 1 [0072.416] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.432] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.436] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.442] CloseHandle (hObject=0x198) returned 1 [0072.443] CloseHandle (hObject=0x19c) returned 1 [0072.444] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.445] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.445] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0072.445] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0072.445] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0072.445] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 1 [0072.446] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\acrobat\\dc\\usercache.bin")) returned 0xffffffff [0072.446] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0072.446] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0072.447] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0072.447] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0072.447] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.447] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0072.447] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.447] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.447] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0072.447] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.447] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.447] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0072.451] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.451] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.451] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e40 [0072.451] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0072.451] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0072.451] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e80 [0072.451] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0072.451] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0072.451] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0072.452] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0072.452] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0072.453] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0072.453] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0072.453] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0072.453] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0072.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0072.454] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0072.454] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0072.454] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e40 [0072.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0072.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0072.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0072.455] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0072.455] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0072.455] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0072.455] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0072.455] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0072.455] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0072.455] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0072.455] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0072.455] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534d00 [0072.455] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.455] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.456] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.456] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0072.459] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.459] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.461] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0072.461] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102a0 [0072.461] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.462] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.469] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.512] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ecac*=0x102a0, lpOverlapped=0x0) returned 1 [0072.543] WriteFile (in: hFile=0x198, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ecac*=0x102b0, lpOverlapped=0x0) returned 1 [0072.544] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.559] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.569] CloseHandle (hObject=0x19c) returned 1 [0072.569] CloseHandle (hObject=0x198) returned 1 [0072.571] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.571] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.571] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0072.572] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0072.572] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0072.572] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 1 [0072.573] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0xffffffff [0072.573] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.573] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0072.573] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.576] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa74 [0072.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.576] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.583] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.624] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0xa74, lpOverlapped=0x0) returned 1 [0072.639] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0xa80, lpOverlapped=0x0) returned 1 [0072.640] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.655] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.658] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.665] CloseHandle (hObject=0x198) returned 1 [0072.665] CloseHandle (hObject=0x19c) returned 1 [0072.666] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.667] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0072.667] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0072.667] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0072.667] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 1 [0072.668] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0xffffffff [0072.668] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0072.668] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0072.668] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0072.668] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0072.668] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0072.668] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0072.668] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.668] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0xffffffff [0072.668] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.668] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\CEF\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535040 [0072.668] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.668] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.668] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\CEF\\User Data\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0072.668] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.668] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.668] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\CEF\\User Data\\Dictionaries\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0072.668] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0072.669] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0072.669] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0072.669] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0072.669] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0072.669] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0072.669] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0072.669] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0072.669] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0072.669] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.669] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.669] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534cc0 [0072.670] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.670] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.670] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0072.670] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.671] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14 [0072.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.671] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.677] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.719] ReadFile (in: hFile=0x188, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ef14*=0x14, lpOverlapped=0x0) returned 1 [0072.720] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ef14*=0x20, lpOverlapped=0x0) returned 1 [0072.721] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.735] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.739] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.746] CloseHandle (hObject=0x188) returned 1 [0072.746] CloseHandle (hObject=0x19c) returned 1 [0072.746] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.747] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.747] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e40 [0072.747] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0072.747] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0072.747] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat")) returned 1 [0072.748] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Temp\\CalendarCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\temp\\calendarcache.dat")) returned 0xffffffff [0072.748] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0072.748] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0072.748] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\Unistore\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535240 [0072.749] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.749] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0072.749] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0072.749] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0072.749] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0072.764] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.764] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.764] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.764] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.765] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0072.766] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0072.766] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.766] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.772] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.813] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ef14*=0x2000, lpOverlapped=0x0) returned 1 [0072.825] WriteFile (in: hFile=0x188, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ef14*=0x2010, lpOverlapped=0x0) returned 1 [0072.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0072.840] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0072.844] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0072.850] CloseHandle (hObject=0x19c) returned 1 [0072.850] CloseHandle (hObject=0x188) returned 1 [0072.851] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0072.851] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0072.852] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535300 [0072.852] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0072.852] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0072.852] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk")) returned 1 [0072.854] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.chk")) returned 0xffffffff [0072.854] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0072.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0072.855] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0072.855] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x300000 [0072.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0072.855] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0072.862] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0072.903] ReadFile (in: hFile=0x188, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ef14*=0x300000, lpOverlapped=0x0) returned 1 [0073.226] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x300010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ef14*=0x300010, lpOverlapped=0x0) returned 1 [0073.268] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0073.283] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0073.286] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.293] CloseHandle (hObject=0x188) returned 1 [0073.293] CloseHandle (hObject=0x19c) returned 1 [0073.370] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0073.370] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0073.370] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0073.370] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0073.370] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0073.370] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log")) returned 1 [0073.377] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USS.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\uss.log")) returned 0xffffffff [0073.377] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0073.377] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0073.378] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0073.378] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0073.378] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0073.378] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x300000 [0073.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0073.379] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0073.386] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0073.431] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x300000, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ef14*=0x300000, lpOverlapped=0x0) returned 1 [0073.618] WriteFile (in: hFile=0x188, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x300010, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ef14*=0x300010, lpOverlapped=0x0) returned 1 [0073.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0073.768] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0073.773] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0073.783] CloseHandle (hObject=0x19c) returned 1 [0073.784] CloseHandle (hObject=0x188) returned 1 [0074.672] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0074.673] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0074.673] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535240 [0074.673] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0074.673] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0074.674] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log")) returned 1 [0074.682] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Comms\\UnistoreDB\\USStmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\comms\\unistoredb\\usstmp.log")) returned 0xffffffff [0074.682] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0074.682] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0074.682] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0074.682] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0074.682] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0074.682] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535400 [0074.682] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0074.683] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0074.683] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0074.683] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0074.683] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0074.683] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0074.685] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0074.686] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0074.686] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0074.692] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.692] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0074.692] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0074.692] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0074.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0074.692] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.692] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.693] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.693] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535080 [0074.695] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.695] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0074.695] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0074.695] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0074.702] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0074.703] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28 [0074.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0074.703] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0074.710] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0074.767] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x28, lpOverlapped=0x0) returned 1 [0074.768] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x30, lpOverlapped=0x0) returned 1 [0074.769] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0074.854] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0074.858] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0074.865] CloseHandle (hObject=0x198) returned 1 [0074.865] CloseHandle (hObject=0x190) returned 1 [0074.866] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0074.866] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0074.866] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0074.866] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0074.866] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0074.867] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1 [0074.868] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0xffffffff [0074.868] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0074.868] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0074.868] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0074.868] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0074.878] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.882] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.882] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534cc0 [0074.904] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.904] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.905] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.905] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.906] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.906] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.906] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.907] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.907] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.908] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.908] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.909] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.909] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.909] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.910] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.910] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.911] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.911] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.912] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.912] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.913] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.913] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.914] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.914] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.915] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.915] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.916] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.916] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.917] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.917] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.918] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.918] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.918] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.919] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.919] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.920] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.920] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0074.920] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0074.921] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.921] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.922] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.922] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.922] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0074.922] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534cc0 [0074.924] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.924] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0074.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0074.926] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0074.928] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c00 [0074.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0074.928] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0074.935] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.064] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1c00, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x1c00, lpOverlapped=0x0) returned 1 [0075.077] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x1c10, lpOverlapped=0x0) returned 1 [0075.079] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.113] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.117] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.124] CloseHandle (hObject=0x198) returned 1 [0075.124] CloseHandle (hObject=0x1a0) returned 1 [0075.125] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.125] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e40 [0075.126] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.126] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0075.126] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db")) returned 1 [0075.127] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\databases\\Databases.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\databases\\databases.db")) returned 0xffffffff [0075.127] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.127] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0075.127] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0075.127] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0075.127] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e40 [0075.151] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.151] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.151] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0075.157] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0075.157] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0075.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.157] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.164] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.265] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x10, lpOverlapped=0x0) returned 1 [0075.266] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.285] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.295] CloseHandle (hObject=0x1a0) returned 1 [0075.296] CloseHandle (hObject=0x198) returned 1 [0075.296] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.296] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.296] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e80 [0075.297] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.297] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0075.297] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log")) returned 1 [0075.297] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log")) returned 0xffffffff [0075.297] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.297] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.298] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.298] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.299] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0075.299] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0075.299] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x168 [0075.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.299] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.308] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.352] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x168, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x168, lpOverlapped=0x0) returned 1 [0075.353] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x170, lpOverlapped=0x0) returned 1 [0075.353] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.369] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.379] CloseHandle (hObject=0x198) returned 1 [0075.379] CloseHandle (hObject=0x1a0) returned 1 [0075.380] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.381] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.381] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535080 [0075.381] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.381] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0075.381] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old")) returned 1 [0075.382] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.old")) returned 0xffffffff [0075.382] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.382] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0075.382] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0075.382] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0075.382] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0075.396] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.396] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.397] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0075.408] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0075.408] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x214 [0075.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.409] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.416] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.466] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x214, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x214, lpOverlapped=0x0) returned 1 [0075.467] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x220, lpOverlapped=0x0) returned 1 [0075.467] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.489] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.492] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.499] CloseHandle (hObject=0x1a0) returned 1 [0075.499] CloseHandle (hObject=0x198) returned 1 [0075.500] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.500] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.500] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0075.500] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.500] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0075.500] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1 [0075.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 0xffffffff [0075.501] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.502] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.502] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.502] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0075.503] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0075.503] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x92 [0075.503] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.503] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.510] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.554] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x92, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x92, lpOverlapped=0x0) returned 1 [0075.554] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0xa0, lpOverlapped=0x0) returned 1 [0075.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.570] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.590] CloseHandle (hObject=0x198) returned 1 [0075.590] CloseHandle (hObject=0x1a0) returned 1 [0075.591] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.591] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534f00 [0075.591] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.591] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0075.591] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old")) returned 1 [0075.592] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.old")) returned 0xffffffff [0075.592] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.592] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0075.592] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0075.593] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0075.593] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0075.605] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.605] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.605] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0075.610] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0075.610] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e6 [0075.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.611] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.617] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.668] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4e6, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x4e6, lpOverlapped=0x0) returned 1 [0075.678] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x4f0, lpOverlapped=0x0) returned 1 [0075.678] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.693] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.706] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.712] CloseHandle (hObject=0x1a0) returned 1 [0075.713] CloseHandle (hObject=0x198) returned 1 [0075.713] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.714] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.714] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534d00 [0075.714] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.714] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0075.714] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1 [0075.715] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 0xffffffff [0075.715] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.716] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.716] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.716] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.717] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0075.717] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0075.718] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0075.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.718] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.725] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.768] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x14e, lpOverlapped=0x0) returned 1 [0075.769] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x150, lpOverlapped=0x0) returned 1 [0075.770] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.861] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.864] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.871] CloseHandle (hObject=0x198) returned 1 [0075.871] CloseHandle (hObject=0x1a0) returned 1 [0075.872] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.872] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.872] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5351c0 [0075.873] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0075.873] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0075.873] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old")) returned 1 [0075.873] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.old")) returned 0xffffffff [0075.873] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.874] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0075.874] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0075.874] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0075.874] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0075.889] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.889] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0075.889] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535080 [0075.889] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0075.890] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0075.890] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x534e40 [0075.901] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0075.901] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0075.901] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0075.905] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0075.905] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2c [0075.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.906] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.912] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0075.956] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xd2c, lpOverlapped=0x0) returned 1 [0075.957] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xd30, lpOverlapped=0x0) returned 1 [0075.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0075.973] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0075.977] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0075.984] CloseHandle (hObject=0x1a4) returned 1 [0075.984] CloseHandle (hObject=0x1a8) returned 1 [0075.985] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0075.985] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0075.985] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0075.985] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0075.986] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0075.986] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0075.987] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0xffffffff [0075.987] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0075.987] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0075.987] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0075.987] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0075.987] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0075.988] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0075.995] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.038] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xa0, lpOverlapped=0x0) returned 1 [0076.041] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xb0, lpOverlapped=0x0) returned 1 [0076.042] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.057] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.060] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.067] CloseHandle (hObject=0x1a8) returned 1 [0076.067] CloseHandle (hObject=0x1a4) returned 1 [0076.070] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.071] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.071] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0076.071] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0076.071] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0076.071] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0076.072] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0xffffffff [0076.072] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0076.073] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0076.073] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0076.073] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0076.074] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.074] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.083] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.131] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5c, lpOverlapped=0x0) returned 1 [0076.133] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0076.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.149] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.153] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.160] CloseHandle (hObject=0x1a4) returned 1 [0076.160] CloseHandle (hObject=0x1a8) returned 1 [0076.161] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.162] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.162] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534f00 [0076.162] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0076.162] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0076.162] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0076.163] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0xffffffff [0076.163] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0076.163] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0076.163] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0076.164] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0076.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.164] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.181] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.232] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5f, lpOverlapped=0x0) returned 1 [0076.233] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0076.234] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.249] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.253] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.262] CloseHandle (hObject=0x1a8) returned 1 [0076.262] CloseHandle (hObject=0x1a4) returned 1 [0076.263] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.263] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.263] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5351c0 [0076.263] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0076.263] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0076.263] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0076.264] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0xffffffff [0076.264] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0076.265] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0076.265] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0076.265] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0076.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.265] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.272] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.318] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x2d5, lpOverlapped=0x0) returned 1 [0076.332] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x2e0, lpOverlapped=0x0) returned 1 [0076.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.347] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.358] CloseHandle (hObject=0x1a4) returned 1 [0076.358] CloseHandle (hObject=0x1a8) returned 1 [0076.359] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.360] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.360] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535200 [0076.360] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0076.360] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0076.360] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1 [0076.361] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0xffffffff [0076.361] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0076.361] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x5351c0 [0076.385] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.385] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.385] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0076.387] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.387] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.387] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0076.387] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0076.388] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0076.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.388] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.395] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.456] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x101, lpOverlapped=0x0) returned 1 [0076.456] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0076.457] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.473] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.476] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.488] CloseHandle (hObject=0x1ac) returned 1 [0076.489] CloseHandle (hObject=0x1b0) returned 1 [0076.490] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.490] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.490] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0076.491] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0076.491] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0076.491] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0076.492] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0076.492] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0076.492] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0076.492] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.492] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0076.492] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.492] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.493] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0076.493] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0076.493] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0076.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.493] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.500] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.552] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0076.553] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0076.554] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.569] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.588] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.594] CloseHandle (hObject=0x1b0) returned 1 [0076.594] CloseHandle (hObject=0x1ac) returned 1 [0076.595] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.596] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.596] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0076.596] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0076.596] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0076.596] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0076.597] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0076.597] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0076.597] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0076.597] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.597] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0076.598] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.598] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.598] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0076.599] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0076.599] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0076.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.599] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.606] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.650] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0076.650] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0076.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.666] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.669] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.676] CloseHandle (hObject=0x1ac) returned 1 [0076.676] CloseHandle (hObject=0x1b0) returned 1 [0076.677] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.677] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.677] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0076.677] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0076.678] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0076.678] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0076.678] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0076.678] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0076.679] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0076.679] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.679] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0076.679] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.679] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.679] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0076.679] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0076.680] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0076.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.682] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.688] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.730] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0076.731] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0076.732] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.747] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.750] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.757] CloseHandle (hObject=0x1b0) returned 1 [0076.757] CloseHandle (hObject=0x1ac) returned 1 [0076.758] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.758] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.758] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0076.759] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0076.759] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0076.759] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0076.760] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0076.760] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0076.760] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0076.760] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.760] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0076.761] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.761] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.761] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0076.761] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0076.762] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0076.762] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.762] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.768] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.897] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0076.897] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0076.901] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.916] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0076.919] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0076.926] CloseHandle (hObject=0x1ac) returned 1 [0076.926] CloseHandle (hObject=0x1b0) returned 1 [0076.927] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0076.927] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0076.927] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0076.928] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0076.928] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0076.928] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0076.928] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0076.928] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0076.929] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0076.929] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0076.929] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0076.929] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.929] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0076.929] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0076.929] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0076.930] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0076.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0076.930] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0076.937] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0076.982] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xea, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0076.983] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0076.999] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.002] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.009] CloseHandle (hObject=0x1b0) returned 1 [0077.009] CloseHandle (hObject=0x1ac) returned 1 [0077.009] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.010] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.010] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0077.010] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.010] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0077.010] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0077.011] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0077.011] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.011] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0077.011] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.011] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0077.014] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.014] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.014] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.015] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.015] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0077.015] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.016] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.022] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.065] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x112, lpOverlapped=0x0) returned 1 [0077.066] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0077.067] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.082] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.085] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.092] CloseHandle (hObject=0x1ac) returned 1 [0077.092] CloseHandle (hObject=0x1b0) returned 1 [0077.093] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.093] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0077.093] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.093] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0077.093] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0077.094] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0077.094] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.094] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0077.094] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.094] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0077.095] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.095] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.095] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.095] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.095] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0077.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.096] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.103] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.147] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd6, lpOverlapped=0x0) returned 1 [0077.150] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.151] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.167] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.170] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.177] CloseHandle (hObject=0x1b0) returned 1 [0077.177] CloseHandle (hObject=0x1ac) returned 1 [0077.177] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.178] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.178] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0077.178] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.178] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0077.178] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0077.179] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0077.179] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.179] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0077.180] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.180] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0077.180] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.180] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.181] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.181] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.181] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0077.181] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.182] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.188] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.232] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd7, lpOverlapped=0x0) returned 1 [0077.234] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.234] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.249] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.253] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.259] CloseHandle (hObject=0x1ac) returned 1 [0077.260] CloseHandle (hObject=0x1b0) returned 1 [0077.260] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.261] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.261] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0077.261] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.261] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0077.261] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0077.262] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0077.262] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.262] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0077.262] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.262] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0077.262] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.262] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.262] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.263] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.263] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0077.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.263] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.270] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.329] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdf, lpOverlapped=0x0) returned 1 [0077.330] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.330] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.347] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.360] CloseHandle (hObject=0x1b0) returned 1 [0077.361] CloseHandle (hObject=0x1ac) returned 1 [0077.361] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.362] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.362] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0077.362] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.362] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0077.362] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0077.364] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0077.364] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.364] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0077.364] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.364] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0077.365] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.365] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.366] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.366] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.367] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0077.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.367] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.376] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.423] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0077.424] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.440] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.443] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.451] CloseHandle (hObject=0x1ac) returned 1 [0077.451] CloseHandle (hObject=0x1b0) returned 1 [0077.452] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.453] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.453] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0077.453] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.453] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0077.453] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0077.454] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0077.454] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.454] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0077.454] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.454] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0077.454] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.454] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.455] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.455] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.455] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0077.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.455] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.462] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.505] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd6, lpOverlapped=0x0) returned 1 [0077.506] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.507] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.523] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.527] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.533] CloseHandle (hObject=0x1b0) returned 1 [0077.533] CloseHandle (hObject=0x1ac) returned 1 [0077.534] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.534] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.535] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0077.535] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.535] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0077.535] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0077.536] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0077.536] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.536] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0077.536] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.536] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0077.537] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.537] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.537] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.537] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.538] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0077.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.538] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.545] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.593] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd9, lpOverlapped=0x0) returned 1 [0077.594] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.595] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.609] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.613] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.622] CloseHandle (hObject=0x1ac) returned 1 [0077.622] CloseHandle (hObject=0x1b0) returned 1 [0077.623] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.623] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.623] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0077.623] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.623] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0077.623] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0077.624] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0077.624] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.624] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0077.624] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0077.625] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.625] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.625] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.625] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.625] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0077.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.626] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.632] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.674] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.675] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0077.675] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.690] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.694] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.700] CloseHandle (hObject=0x1b0) returned 1 [0077.701] CloseHandle (hObject=0x1ac) returned 1 [0077.701] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.702] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.702] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0077.702] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.702] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0077.702] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0077.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0077.703] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.703] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0077.703] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.703] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0077.704] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.704] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.704] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.705] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.705] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0077.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.705] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.712] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.754] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0077.755] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0077.756] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.770] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.874] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.880] CloseHandle (hObject=0x1ac) returned 1 [0077.880] CloseHandle (hObject=0x1b0) returned 1 [0077.881] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.882] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.882] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0077.882] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.882] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0077.882] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0077.885] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0077.885] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.885] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0077.885] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.885] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0077.885] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.885] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.886] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.886] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.886] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0077.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.886] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.893] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0077.936] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe1, lpOverlapped=0x0) returned 1 [0077.937] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0077.937] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0077.952] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0077.956] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0077.963] CloseHandle (hObject=0x1b0) returned 1 [0077.963] CloseHandle (hObject=0x1ac) returned 1 [0077.964] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0077.964] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0077.964] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0077.965] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0077.965] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0077.965] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0077.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0077.966] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0077.966] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0077.966] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0077.966] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0077.968] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.968] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0077.968] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0077.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0077.969] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123 [0077.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0077.969] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0077.976] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.018] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x123, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x123, lpOverlapped=0x0) returned 1 [0078.019] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0078.020] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.035] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.039] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.045] CloseHandle (hObject=0x1ac) returned 1 [0078.045] CloseHandle (hObject=0x1b0) returned 1 [0078.046] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.047] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.047] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0078.047] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.047] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0078.047] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0078.048] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0078.048] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.048] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0078.048] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.048] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0078.048] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.048] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.048] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.049] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.050] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0078.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.050] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.057] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.100] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe6, lpOverlapped=0x0) returned 1 [0078.101] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0078.102] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.116] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.120] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.127] CloseHandle (hObject=0x1b0) returned 1 [0078.127] CloseHandle (hObject=0x1ac) returned 1 [0078.128] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.128] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0078.128] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.128] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0078.128] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0078.129] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0078.129] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.129] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0078.129] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.129] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0078.130] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.130] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.131] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.131] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.131] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0078.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.181] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0078.182] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0078.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.197] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.207] CloseHandle (hObject=0x1ac) returned 1 [0078.207] CloseHandle (hObject=0x1b0) returned 1 [0078.208] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.209] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0078.209] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.209] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0078.209] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0078.210] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0078.210] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.210] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0078.210] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.210] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0078.210] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.210] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.210] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.211] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.211] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0078.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.213] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.219] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.262] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0078.262] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0078.263] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.278] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.281] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.287] CloseHandle (hObject=0x1b0) returned 1 [0078.288] CloseHandle (hObject=0x1ac) returned 1 [0078.288] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.289] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.289] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0078.289] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.289] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0078.289] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0078.290] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0078.290] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.290] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0078.290] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.290] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0078.291] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.291] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.292] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.292] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.292] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0078.292] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.292] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.299] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.343] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xec, lpOverlapped=0x0) returned 1 [0078.344] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0078.345] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.360] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.363] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.370] CloseHandle (hObject=0x1ac) returned 1 [0078.370] CloseHandle (hObject=0x1b0) returned 1 [0078.371] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.371] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.372] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0078.372] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.372] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0078.372] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0078.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0078.373] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.373] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0078.373] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.373] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0078.373] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.373] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.373] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.373] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.374] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0078.374] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.374] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.381] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe6, lpOverlapped=0x0) returned 1 [0078.427] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0078.428] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.443] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.447] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.454] CloseHandle (hObject=0x1b0) returned 1 [0078.454] CloseHandle (hObject=0x1ac) returned 1 [0078.455] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.455] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0078.455] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.455] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0078.455] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0078.456] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0078.456] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.456] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0078.456] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.456] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0078.459] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.459] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.460] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0078.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.460] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.467] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.509] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe4, lpOverlapped=0x0) returned 1 [0078.510] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0078.511] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.529] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.536] CloseHandle (hObject=0x1ac) returned 1 [0078.536] CloseHandle (hObject=0x1b0) returned 1 [0078.537] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.538] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0078.538] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.538] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0078.538] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0078.539] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0078.539] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.539] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0078.542] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.542] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0078.542] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.542] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.542] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.543] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.543] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0078.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.543] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.550] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.608] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe9, lpOverlapped=0x0) returned 1 [0078.609] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0078.609] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.626] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.630] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.636] CloseHandle (hObject=0x1b0) returned 1 [0078.637] CloseHandle (hObject=0x1ac) returned 1 [0078.638] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.638] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.638] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0078.638] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.638] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0078.638] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0078.639] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0078.639] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.639] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0078.639] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.639] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0078.641] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.641] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.642] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0078.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.642] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.650] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.696] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0078.696] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0078.697] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.712] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.716] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.723] CloseHandle (hObject=0x1ac) returned 1 [0078.723] CloseHandle (hObject=0x1b0) returned 1 [0078.724] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.725] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.725] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0078.725] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.725] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0078.725] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0078.726] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0078.726] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.726] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0078.726] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.726] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0078.727] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.727] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.728] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.728] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.728] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0078.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.728] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.735] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.873] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0078.874] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0078.875] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.890] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.893] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.900] CloseHandle (hObject=0x1b0) returned 1 [0078.900] CloseHandle (hObject=0x1ac) returned 1 [0078.901] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.901] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.901] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0078.902] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.902] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0078.902] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0078.902] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0078.903] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.903] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0078.903] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.903] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0078.904] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.904] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.904] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.904] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.905] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0078.905] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.905] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.912] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0078.954] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcb, lpOverlapped=0x0) returned 1 [0078.955] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0078.956] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0078.970] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0078.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0078.981] CloseHandle (hObject=0x1ac) returned 1 [0078.981] CloseHandle (hObject=0x1b0) returned 1 [0078.982] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0078.982] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0078.983] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0078.983] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0078.983] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0078.983] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0078.984] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0078.984] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0078.984] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0078.984] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0078.984] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0078.984] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.984] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0078.984] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0078.984] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0078.985] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0078.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0078.985] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0078.992] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.034] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd9, lpOverlapped=0x0) returned 1 [0079.036] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0079.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.052] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.055] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.062] CloseHandle (hObject=0x1b0) returned 1 [0079.062] CloseHandle (hObject=0x1ac) returned 1 [0079.063] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.063] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.063] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0079.064] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.064] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0079.064] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0079.064] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0079.065] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.065] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0079.065] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.065] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0079.066] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.066] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.066] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.066] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.067] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0079.067] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.067] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.074] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.116] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0079.117] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0079.117] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.134] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.144] CloseHandle (hObject=0x1ac) returned 1 [0079.144] CloseHandle (hObject=0x1b0) returned 1 [0079.145] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.146] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.146] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0079.146] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.146] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0079.146] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0079.147] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0079.147] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.147] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0079.147] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.147] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0079.147] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.147] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.148] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.148] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.148] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0079.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.148] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.155] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.198] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0079.202] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0079.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.218] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.221] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.228] CloseHandle (hObject=0x1b0) returned 1 [0079.228] CloseHandle (hObject=0x1ac) returned 1 [0079.229] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.229] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.229] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0079.229] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.229] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0079.229] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0079.230] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0079.230] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.230] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0079.230] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.230] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0079.233] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.233] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.233] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.233] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.234] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0079.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.234] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.241] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.287] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0079.288] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0079.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.314] CloseHandle (hObject=0x1ac) returned 1 [0079.314] CloseHandle (hObject=0x1b0) returned 1 [0079.314] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0079.315] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.315] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0079.315] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0079.316] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0079.316] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.316] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0079.316] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.316] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0079.317] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.317] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.317] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.318] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.318] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0079.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.318] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.325] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.367] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0079.368] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0079.369] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.384] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.387] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.394] CloseHandle (hObject=0x1b0) returned 1 [0079.394] CloseHandle (hObject=0x1ac) returned 1 [0079.395] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.395] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.395] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0079.395] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.395] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0079.396] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0079.396] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0079.397] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.397] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0079.397] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.397] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0079.398] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.398] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.398] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.398] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.399] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0079.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.399] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.405] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.496] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe3, lpOverlapped=0x0) returned 1 [0079.497] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0079.498] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.512] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.523] CloseHandle (hObject=0x1ac) returned 1 [0079.523] CloseHandle (hObject=0x1b0) returned 1 [0079.524] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.524] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.524] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0079.524] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.524] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0079.524] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0079.525] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0079.525] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.525] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0079.525] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.525] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0079.525] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.526] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.526] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0079.526] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.526] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.533] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.576] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdf, lpOverlapped=0x0) returned 1 [0079.583] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0079.584] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.601] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.604] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.611] CloseHandle (hObject=0x1b0) returned 1 [0079.611] CloseHandle (hObject=0x1ac) returned 1 [0079.611] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.612] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.612] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0079.612] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.612] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0079.612] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0079.614] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0079.614] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.614] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0079.614] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.614] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0079.615] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.615] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.615] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.615] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.615] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0079.616] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.616] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.622] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.664] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x104, lpOverlapped=0x0) returned 1 [0079.666] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0079.666] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.681] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.685] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.691] CloseHandle (hObject=0x1ac) returned 1 [0079.691] CloseHandle (hObject=0x1b0) returned 1 [0079.692] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.693] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.693] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0079.693] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.693] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0079.693] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0079.694] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0079.694] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.694] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0079.694] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.694] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0079.694] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.694] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.695] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0079.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.695] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.702] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.889] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe2, lpOverlapped=0x0) returned 1 [0079.890] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0079.891] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.906] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0079.911] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0079.918] CloseHandle (hObject=0x1b0) returned 1 [0079.918] CloseHandle (hObject=0x1ac) returned 1 [0079.919] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0079.919] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0079.919] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0079.920] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0079.920] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0079.920] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0079.921] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0079.921] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0079.921] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0079.921] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0079.921] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0079.926] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.926] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0079.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0079.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0079.927] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0079.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0079.928] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0079.934] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0079.982] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x104, lpOverlapped=0x0) returned 1 [0079.983] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0079.984] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0079.999] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.003] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.010] CloseHandle (hObject=0x1ac) returned 1 [0080.010] CloseHandle (hObject=0x1b0) returned 1 [0080.011] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.011] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.011] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0080.011] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0080.011] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0080.011] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0080.012] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0080.012] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0080.012] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0080.013] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.013] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0080.013] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.013] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.013] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0080.013] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.013] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0080.014] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.014] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.020] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.066] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0080.066] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0080.067] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.082] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.086] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.093] CloseHandle (hObject=0x1b0) returned 1 [0080.093] CloseHandle (hObject=0x1ac) returned 1 [0080.093] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.094] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.094] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0080.094] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0080.094] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0080.094] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0080.095] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0080.095] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0080.095] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0080.095] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.095] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0080.096] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.096] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.097] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.097] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0080.097] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0080.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.097] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.104] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.148] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10e, lpOverlapped=0x0) returned 1 [0080.149] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0080.149] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.164] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.168] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.175] CloseHandle (hObject=0x1ac) returned 1 [0080.175] CloseHandle (hObject=0x1b0) returned 1 [0080.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.177] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0080.177] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0080.177] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0080.177] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0080.178] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0080.178] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0080.178] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0080.178] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.178] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0080.178] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.178] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.179] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0080.179] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.179] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0080.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.179] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.187] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.243] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xed, lpOverlapped=0x0) returned 1 [0080.244] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0080.245] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.259] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.263] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.269] CloseHandle (hObject=0x1b0) returned 1 [0080.269] CloseHandle (hObject=0x1ac) returned 1 [0080.270] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.271] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.271] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0080.271] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0080.271] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0080.271] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0080.272] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0080.272] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0080.272] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0080.272] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.272] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0080.273] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.273] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.273] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.273] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0080.274] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0080.274] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.274] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.281] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.323] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd7, lpOverlapped=0x0) returned 1 [0080.324] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0080.325] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.340] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.343] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.350] CloseHandle (hObject=0x1ac) returned 1 [0080.350] CloseHandle (hObject=0x1b0) returned 1 [0080.351] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.351] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.352] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0080.352] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0080.352] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0080.352] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0080.353] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0080.353] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0080.353] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0080.354] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.354] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0080.354] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.354] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0080.354] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0080.354] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.355] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0080.355] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.355] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.361] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.404] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd1, lpOverlapped=0x0) returned 1 [0080.405] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0080.405] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.420] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.430] CloseHandle (hObject=0x1b0) returned 1 [0080.430] CloseHandle (hObject=0x1ac) returned 1 [0080.431] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.431] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.432] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0080.432] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0080.432] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0080.432] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0080.433] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0080.433] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0080.433] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0080.433] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0080.433] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0080.433] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0080.433] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x5351c0 [0080.434] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.434] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.434] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0080.435] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.449] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0080.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.449] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.456] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.497] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x160, lpOverlapped=0x0) returned 1 [0080.498] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x170, lpOverlapped=0x0) returned 1 [0080.499] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.514] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.517] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.524] CloseHandle (hObject=0x1a4) returned 1 [0080.524] CloseHandle (hObject=0x1ac) returned 1 [0080.524] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.525] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.525] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534e80 [0080.525] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0080.525] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0080.525] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0080.526] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0080.526] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0080.527] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0080.527] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0080.527] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0080.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.527] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.534] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.576] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2b56, lpOverlapped=0x0) returned 1 [0080.588] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2b60, lpOverlapped=0x0) returned 1 [0080.589] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.604] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.608] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.614] CloseHandle (hObject=0x1ac) returned 1 [0080.614] CloseHandle (hObject=0x1a4) returned 1 [0080.615] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.615] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.616] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535300 [0080.616] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0080.616] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0080.616] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0080.617] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0080.617] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0080.617] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0080.617] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0080.617] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0080.617] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0080.617] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0080.617] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0080.617] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534ec0 [0080.617] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0080.617] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0080.617] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x535200 [0080.639] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0080.639] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0080.640] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0080.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0080.642] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8d [0080.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.642] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.649] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.755] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc8d, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xc8d, lpOverlapped=0x0) returned 1 [0080.767] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xc90, lpOverlapped=0x0) returned 1 [0080.767] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.828] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.832] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.853] CloseHandle (hObject=0x1a8) returned 1 [0080.853] CloseHandle (hObject=0x1a4) returned 1 [0080.854] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.855] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.855] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535300 [0080.855] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0080.855] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0080.855] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0080.856] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0xffffffff [0080.856] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0080.856] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0080.857] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0080.857] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f [0080.857] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.857] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.864] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.909] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x8f, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x8f, lpOverlapped=0x0) returned 1 [0080.909] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x90, lpOverlapped=0x0) returned 1 [0080.910] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0080.926] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0080.929] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0080.939] CloseHandle (hObject=0x1a4) returned 1 [0080.939] CloseHandle (hObject=0x1a8) returned 1 [0080.940] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0080.940] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0080.941] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5351c0 [0080.941] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0080.941] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0080.941] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0080.942] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0xffffffff [0080.942] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0080.942] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0080.945] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0080.945] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0080.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0080.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0080.953] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0080.999] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5c, lpOverlapped=0x0) returned 1 [0080.999] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0081.000] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.016] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.019] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.028] CloseHandle (hObject=0x1a8) returned 1 [0081.028] CloseHandle (hObject=0x1a4) returned 1 [0081.028] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.029] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.029] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534f00 [0081.029] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0081.029] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0081.029] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1 [0081.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 0xffffffff [0081.030] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0081.030] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0081.033] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0081.033] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b [0081.033] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.033] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.040] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.089] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5b, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5b, lpOverlapped=0x0) returned 1 [0081.090] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0081.091] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.106] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.110] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.117] CloseHandle (hObject=0x1a4) returned 1 [0081.117] CloseHandle (hObject=0x1a8) returned 1 [0081.118] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.118] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.118] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535240 [0081.118] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0081.118] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0081.122] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1 [0081.123] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 0xffffffff [0081.123] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0081.124] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0081.124] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0081.124] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d5 [0081.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.125] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.133] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.179] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2d5, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x2d5, lpOverlapped=0x0) returned 1 [0081.180] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x2e0, lpOverlapped=0x0) returned 1 [0081.181] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.197] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.207] CloseHandle (hObject=0x1a8) returned 1 [0081.208] CloseHandle (hObject=0x1a4) returned 1 [0081.208] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.209] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535240 [0081.209] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0081.209] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0081.209] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 1 [0081.210] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 0xffffffff [0081.210] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0081.210] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535240 [0081.214] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.214] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.214] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0081.214] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.214] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.214] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.216] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.216] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6 [0081.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.217] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.223] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.270] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf6, lpOverlapped=0x0) returned 1 [0081.271] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0081.271] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.286] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.290] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.297] CloseHandle (hObject=0x1ac) returned 1 [0081.297] CloseHandle (hObject=0x1b0) returned 1 [0081.297] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.298] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.298] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0081.298] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.298] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0081.298] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0081.299] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0081.299] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.299] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0081.299] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.299] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0081.300] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.300] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.300] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.300] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.300] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0081.300] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.301] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.309] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.353] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x108, lpOverlapped=0x0) returned 1 [0081.354] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0081.355] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.397] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.419] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.425] CloseHandle (hObject=0x1b0) returned 1 [0081.425] CloseHandle (hObject=0x1ac) returned 1 [0081.426] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.426] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0081.427] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.427] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0081.427] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0081.427] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0081.427] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.427] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0081.428] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.428] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0081.428] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.428] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.428] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.429] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.429] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0081.429] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.430] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.436] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.479] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcf, lpOverlapped=0x0) returned 1 [0081.479] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0081.480] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.495] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.498] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.505] CloseHandle (hObject=0x1ac) returned 1 [0081.505] CloseHandle (hObject=0x1b0) returned 1 [0081.506] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.506] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.506] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0081.506] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.507] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0081.507] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0081.507] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0081.507] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.507] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0081.508] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.508] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0081.508] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.508] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.508] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.508] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.509] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0081.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.509] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.516] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.558] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0081.559] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0081.559] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.574] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.578] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.584] CloseHandle (hObject=0x1b0) returned 1 [0081.584] CloseHandle (hObject=0x1ac) returned 1 [0081.585] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.586] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.586] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0081.587] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.587] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0081.587] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0081.593] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0081.593] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.593] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0081.594] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.594] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0081.594] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.594] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.594] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.596] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.596] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0081.596] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.596] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.603] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.645] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd8, lpOverlapped=0x0) returned 1 [0081.645] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0081.646] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.661] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.665] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.671] CloseHandle (hObject=0x1ac) returned 1 [0081.672] CloseHandle (hObject=0x1b0) returned 1 [0081.672] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.673] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.673] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0081.673] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.673] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0081.673] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0081.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0xffffffff [0081.674] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.674] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0081.674] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.674] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0081.674] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.674] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.675] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.675] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.675] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0081.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.675] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.682] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.724] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd9, lpOverlapped=0x0) returned 1 [0081.725] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0081.725] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.740] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.744] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.750] CloseHandle (hObject=0x1b0) returned 1 [0081.751] CloseHandle (hObject=0x1ac) returned 1 [0081.752] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.752] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.752] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0081.753] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.753] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0081.753] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0081.754] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 0xffffffff [0081.754] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.754] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0081.754] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.754] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0081.754] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.754] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.755] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.756] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0081.756] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.756] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.763] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0081.940] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x104, lpOverlapped=0x0) returned 1 [0081.940] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0081.941] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0081.956] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0081.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0081.966] CloseHandle (hObject=0x1ac) returned 1 [0081.966] CloseHandle (hObject=0x1b0) returned 1 [0081.967] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0081.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0081.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0081.967] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0081.967] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0081.967] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0081.968] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 0xffffffff [0081.968] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0081.968] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0081.968] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0081.968] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0081.969] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.969] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0081.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0081.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0081.969] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0081.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0081.970] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0081.976] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.022] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0082.023] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.024] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.039] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.043] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.050] CloseHandle (hObject=0x1b0) returned 1 [0082.050] CloseHandle (hObject=0x1ac) returned 1 [0082.051] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.051] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.051] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0082.051] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.051] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0082.051] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0082.052] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0082.052] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.052] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0082.052] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.052] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0082.052] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.053] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.053] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.054] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.054] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0082.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.054] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.064] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.106] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd1, lpOverlapped=0x0) returned 1 [0082.107] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.108] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.122] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.126] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.132] CloseHandle (hObject=0x1ac) returned 1 [0082.132] CloseHandle (hObject=0x1b0) returned 1 [0082.133] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.134] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.134] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0082.135] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.135] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0082.135] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0082.136] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0082.136] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.136] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0082.136] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.136] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0082.136] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.136] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.136] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.137] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.137] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0082.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.137] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.144] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.186] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xce, lpOverlapped=0x0) returned 1 [0082.188] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0082.188] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.204] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.215] CloseHandle (hObject=0x1b0) returned 1 [0082.215] CloseHandle (hObject=0x1ac) returned 1 [0082.216] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.216] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.216] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0082.216] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.216] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0082.217] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0082.217] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0xffffffff [0082.217] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.218] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0082.218] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.218] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0082.218] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.218] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.218] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.219] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.220] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0082.220] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.220] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.226] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.270] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xce, lpOverlapped=0x0) returned 1 [0082.271] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0082.272] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.287] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.298] CloseHandle (hObject=0x1ac) returned 1 [0082.299] CloseHandle (hObject=0x1b0) returned 1 [0082.299] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.299] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.299] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0082.300] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.300] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0082.300] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0082.301] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0082.301] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.301] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0082.301] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.301] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0082.301] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.301] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.301] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.302] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.302] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0082.302] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.302] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.310] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.355] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd8, lpOverlapped=0x0) returned 1 [0082.356] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.356] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.373] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.377] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.383] CloseHandle (hObject=0x1b0) returned 1 [0082.384] CloseHandle (hObject=0x1ac) returned 1 [0082.385] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.385] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.386] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0082.386] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.386] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0082.386] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0082.387] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0xffffffff [0082.387] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.387] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0082.387] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.387] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0082.388] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.388] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.388] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.389] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.390] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0082.390] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.390] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.399] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.456] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd8, lpOverlapped=0x0) returned 1 [0082.457] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.458] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.482] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.486] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.494] CloseHandle (hObject=0x1ac) returned 1 [0082.494] CloseHandle (hObject=0x1b0) returned 1 [0082.495] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.495] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.495] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0082.496] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.496] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0082.496] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0082.497] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0082.497] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.497] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0082.497] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.497] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0082.497] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.497] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.497] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.498] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.498] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0082.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.498] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.505] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.549] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdb, lpOverlapped=0x0) returned 1 [0082.550] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.550] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.566] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.569] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.576] CloseHandle (hObject=0x1b0) returned 1 [0082.577] CloseHandle (hObject=0x1ac) returned 1 [0082.577] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.578] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.578] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0082.578] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.578] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0082.578] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0082.579] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0082.579] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.579] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0082.579] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.579] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0082.579] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.579] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.580] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.581] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.581] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0082.581] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.582] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.595] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.638] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd7, lpOverlapped=0x0) returned 1 [0082.639] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.655] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.658] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.665] CloseHandle (hObject=0x1ac) returned 1 [0082.665] CloseHandle (hObject=0x1b0) returned 1 [0082.667] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.667] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0082.667] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.667] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0082.668] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0082.668] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0082.668] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.669] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0082.669] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.669] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0082.669] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.669] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.669] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.669] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.670] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0082.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.670] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.677] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.720] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0082.721] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0082.722] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.738] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.742] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.749] CloseHandle (hObject=0x1b0) returned 1 [0082.749] CloseHandle (hObject=0x1ac) returned 1 [0082.750] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.750] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.750] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0082.750] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.750] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0082.750] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0082.751] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0xffffffff [0082.751] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.751] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0082.751] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.751] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0082.752] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.752] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.752] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.753] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.753] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0082.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.753] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.760] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.897] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x117, lpOverlapped=0x0) returned 1 [0082.898] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0082.898] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.913] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.917] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0082.924] CloseHandle (hObject=0x1ac) returned 1 [0082.924] CloseHandle (hObject=0x1b0) returned 1 [0082.925] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0082.925] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0082.925] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0082.926] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0082.926] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0082.926] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0082.927] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0082.927] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0082.927] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0082.927] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0082.927] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0082.927] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.927] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0082.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0082.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0082.928] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0082.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0082.928] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0082.935] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0082.979] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xeb, lpOverlapped=0x0) returned 1 [0082.980] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0082.981] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0082.996] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0082.999] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.006] CloseHandle (hObject=0x1b0) returned 1 [0083.006] CloseHandle (hObject=0x1ac) returned 1 [0083.007] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.007] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.007] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0083.007] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.008] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0083.008] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0083.008] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0083.009] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.009] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0083.009] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.009] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0083.009] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.009] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.009] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.010] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.011] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0083.011] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.011] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.018] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.062] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd1, lpOverlapped=0x0) returned 1 [0083.063] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.064] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.079] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.082] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.089] CloseHandle (hObject=0x1ac) returned 1 [0083.090] CloseHandle (hObject=0x1b0) returned 1 [0083.090] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.091] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.091] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0083.091] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.091] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0083.091] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0083.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0xffffffff [0083.092] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.092] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0083.092] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0083.092] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.092] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.093] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.093] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.093] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0083.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.093] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.101] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.144] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0083.145] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.146] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.161] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.165] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.172] CloseHandle (hObject=0x1b0) returned 1 [0083.172] CloseHandle (hObject=0x1ac) returned 1 [0083.173] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.173] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.173] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0083.174] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.174] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0083.174] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0083.175] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0xffffffff [0083.175] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.175] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0083.175] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.175] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0083.175] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.175] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.175] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.177] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.178] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0083.178] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.178] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.185] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.230] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0083.230] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.231] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.246] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.250] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.256] CloseHandle (hObject=0x1ac) returned 1 [0083.257] CloseHandle (hObject=0x1b0) returned 1 [0083.257] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.258] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.258] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0083.258] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.258] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0083.258] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0083.259] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0083.259] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.259] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0083.259] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.259] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0083.260] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.260] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.260] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.260] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.260] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0083.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.261] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.267] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.311] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xda, lpOverlapped=0x0) returned 1 [0083.313] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.329] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.333] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.340] CloseHandle (hObject=0x1b0) returned 1 [0083.340] CloseHandle (hObject=0x1ac) returned 1 [0083.341] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.341] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.341] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0083.341] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.341] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0083.342] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0083.342] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0083.342] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.342] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0083.343] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.343] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0083.343] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.343] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.343] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.345] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.345] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4 [0083.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.346] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.352] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.396] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe4, lpOverlapped=0x0) returned 1 [0083.397] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0083.398] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.413] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.417] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.425] CloseHandle (hObject=0x1ac) returned 1 [0083.425] CloseHandle (hObject=0x1b0) returned 1 [0083.425] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.426] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0083.426] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.426] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0083.426] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0083.427] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0083.427] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.427] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0083.427] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.427] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0083.428] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.428] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.428] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.428] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.428] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0083.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.429] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.436] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.477] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.479] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0083.480] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.495] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.499] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.506] CloseHandle (hObject=0x1b0) returned 1 [0083.506] CloseHandle (hObject=0x1ac) returned 1 [0083.507] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.507] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.507] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0083.507] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.508] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0083.508] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0083.509] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0083.509] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.509] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0083.509] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.509] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0083.509] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.509] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.510] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.511] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.512] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0083.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.512] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.519] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.564] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcf, lpOverlapped=0x0) returned 1 [0083.566] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0083.566] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.582] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.586] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.601] CloseHandle (hObject=0x1ac) returned 1 [0083.602] CloseHandle (hObject=0x1b0) returned 1 [0083.603] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.603] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.603] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0083.603] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.603] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0083.604] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0083.605] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0083.605] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.605] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0083.605] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.605] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0083.605] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.605] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.606] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.606] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.607] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0083.607] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.607] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.616] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.663] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd9, lpOverlapped=0x0) returned 1 [0083.664] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.665] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.680] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.691] CloseHandle (hObject=0x1b0) returned 1 [0083.691] CloseHandle (hObject=0x1ac) returned 1 [0083.694] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.695] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.695] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0083.695] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.695] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0083.695] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0083.696] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0083.696] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.696] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0083.696] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.696] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0083.696] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.696] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.697] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.698] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.698] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc3 [0083.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.698] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.706] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.748] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc3, lpOverlapped=0x0) returned 1 [0083.749] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0083.750] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.765] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.769] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.775] CloseHandle (hObject=0x1ac) returned 1 [0083.775] CloseHandle (hObject=0x1b0) returned 1 [0083.776] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.776] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.776] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0083.777] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.777] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0083.777] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0083.777] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 0xffffffff [0083.778] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.778] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0083.778] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.778] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0083.778] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.875] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.875] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.875] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.876] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0083.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.876] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.883] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0083.926] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0083.927] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0083.928] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0083.944] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0083.948] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.955] CloseHandle (hObject=0x1b0) returned 1 [0083.955] CloseHandle (hObject=0x1ac) returned 1 [0083.956] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0083.956] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0083.956] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0083.956] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0083.956] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0083.957] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0083.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0083.957] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0083.957] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0083.961] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0083.961] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0083.961] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.961] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0083.961] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0083.971] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0083.971] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0083.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0083.971] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0083.978] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.021] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xce, lpOverlapped=0x0) returned 1 [0084.021] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0084.022] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.038] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.041] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.048] CloseHandle (hObject=0x1ac) returned 1 [0084.048] CloseHandle (hObject=0x1b0) returned 1 [0084.049] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.050] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.050] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0084.050] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.050] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0084.050] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0084.051] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0084.051] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.051] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0084.051] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.051] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0084.052] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.052] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.052] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.053] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.053] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0084.053] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.053] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.060] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.102] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0084.103] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0084.104] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.119] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.123] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.130] CloseHandle (hObject=0x1b0) returned 1 [0084.130] CloseHandle (hObject=0x1ac) returned 1 [0084.130] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.131] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.131] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0084.131] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.131] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0084.131] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0084.132] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0084.132] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.132] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0084.132] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.132] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0084.132] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.132] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.133] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.133] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.133] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0084.133] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.133] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.142] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.183] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0084.185] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0084.185] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.201] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.204] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.211] CloseHandle (hObject=0x1ac) returned 1 [0084.211] CloseHandle (hObject=0x1b0) returned 1 [0084.212] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.212] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.212] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0084.212] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.212] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0084.212] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0084.213] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0084.213] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.213] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0084.213] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.213] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0084.215] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.215] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.215] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.215] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.215] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0084.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.216] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.224] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.267] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10a, lpOverlapped=0x0) returned 1 [0084.268] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0084.268] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.283] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.287] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.294] CloseHandle (hObject=0x1b0) returned 1 [0084.294] CloseHandle (hObject=0x1ac) returned 1 [0084.295] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.295] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.295] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0084.295] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.295] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0084.295] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0084.296] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0084.296] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.296] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0084.296] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.296] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0084.297] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.297] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.297] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.297] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.297] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0084.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.298] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.305] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.397] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0084.409] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0084.426] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.448] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.452] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.459] CloseHandle (hObject=0x1ac) returned 1 [0084.460] CloseHandle (hObject=0x1b0) returned 1 [0084.468] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.469] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.469] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0084.469] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.469] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0084.469] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0084.470] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0084.470] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.470] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0084.470] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.470] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0084.472] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.472] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.472] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.473] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.473] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0084.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.473] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.480] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.533] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xda, lpOverlapped=0x0) returned 1 [0084.533] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0084.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.549] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.562] CloseHandle (hObject=0x1b0) returned 1 [0084.562] CloseHandle (hObject=0x1ac) returned 1 [0084.563] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.564] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.564] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0084.564] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.564] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0084.564] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0084.565] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0084.565] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.565] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0084.565] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.565] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0084.565] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.565] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.566] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.566] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.566] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0084.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.566] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.574] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.623] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf8, lpOverlapped=0x0) returned 1 [0084.624] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0084.625] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.641] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.646] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.653] CloseHandle (hObject=0x1ac) returned 1 [0084.653] CloseHandle (hObject=0x1b0) returned 1 [0084.655] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.655] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.655] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0084.655] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.655] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0084.655] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0084.656] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0084.656] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.656] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0084.657] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.657] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0084.659] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.659] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.659] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.659] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.659] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd6 [0084.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.660] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.666] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.710] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd6, lpOverlapped=0x0) returned 1 [0084.711] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0084.712] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.728] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.732] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.739] CloseHandle (hObject=0x1b0) returned 1 [0084.739] CloseHandle (hObject=0x1ac) returned 1 [0084.740] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.741] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.741] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0084.741] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.741] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0084.741] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0084.742] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0084.742] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.742] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0084.742] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.742] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0084.743] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.743] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.743] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.743] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.743] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0084.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.744] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.754] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.893] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfe, lpOverlapped=0x0) returned 1 [0084.893] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0084.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.910] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.921] CloseHandle (hObject=0x1ac) returned 1 [0084.921] CloseHandle (hObject=0x1b0) returned 1 [0084.922] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0084.922] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0084.922] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0084.922] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0084.923] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0084.923] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0084.923] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 0xffffffff [0084.924] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0084.924] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0084.924] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0084.924] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0084.926] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.926] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0084.926] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0084.926] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0084.927] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0084.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0084.927] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0084.934] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0084.979] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe3, lpOverlapped=0x0) returned 1 [0084.980] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0084.980] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0084.996] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0084.999] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.006] CloseHandle (hObject=0x1b0) returned 1 [0085.006] CloseHandle (hObject=0x1ac) returned 1 [0085.007] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.007] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.007] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0085.008] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0085.008] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0085.008] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0085.009] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0085.009] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0085.009] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0085.009] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.009] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0085.009] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.009] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.009] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.009] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0085.010] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0085.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.010] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.018] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.067] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x108, lpOverlapped=0x0) returned 1 [0085.068] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0085.069] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.084] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.090] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.097] CloseHandle (hObject=0x1ac) returned 1 [0085.097] CloseHandle (hObject=0x1b0) returned 1 [0085.097] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.098] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.098] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0085.098] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0085.098] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0085.098] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0085.099] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0085.099] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0085.099] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0085.101] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.101] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0085.107] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.107] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.108] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0085.108] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.108] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0085.108] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.108] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.115] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.160] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe1, lpOverlapped=0x0) returned 1 [0085.162] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0085.162] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.178] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.189] CloseHandle (hObject=0x1b0) returned 1 [0085.189] CloseHandle (hObject=0x1ac) returned 1 [0085.190] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.190] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.190] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0085.190] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0085.190] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0085.190] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0085.191] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0085.191] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0085.191] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0085.191] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.191] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0085.192] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.192] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.192] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.192] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0085.192] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0085.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.193] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.199] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.244] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xce, lpOverlapped=0x0) returned 1 [0085.246] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0085.247] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.262] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.266] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.272] CloseHandle (hObject=0x1ac) returned 1 [0085.272] CloseHandle (hObject=0x1b0) returned 1 [0085.273] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.274] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.274] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0085.274] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0085.274] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0085.274] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0085.275] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0085.275] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0085.275] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0085.275] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.275] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0085.275] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.275] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.275] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0085.276] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.276] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0085.276] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.276] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.284] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.325] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xce, lpOverlapped=0x0) returned 1 [0085.326] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0085.327] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.342] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.346] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.352] CloseHandle (hObject=0x1b0) returned 1 [0085.352] CloseHandle (hObject=0x1ac) returned 1 [0085.353] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.353] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.354] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0085.354] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0085.354] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0085.354] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0085.355] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0085.355] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0085.355] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0085.355] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0085.355] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0085.355] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0085.355] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535240 [0085.355] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.355] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.355] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0085.358] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.370] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0085.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.371] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.378] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.423] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x160, lpOverlapped=0x0) returned 1 [0085.423] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x170, lpOverlapped=0x0) returned 1 [0085.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.439] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.443] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.450] CloseHandle (hObject=0x1a8) returned 1 [0085.450] CloseHandle (hObject=0x1ac) returned 1 [0085.451] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.451] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.451] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534cc0 [0085.451] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0085.451] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0085.452] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0085.452] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0085.453] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.453] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.453] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0085.453] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0085.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.454] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.460] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.504] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2b56, lpOverlapped=0x0) returned 1 [0085.520] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2b60, lpOverlapped=0x0) returned 1 [0085.521] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.536] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.540] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.549] CloseHandle (hObject=0x1ac) returned 1 [0085.549] CloseHandle (hObject=0x1a8) returned 1 [0085.550] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.551] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.551] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534f40 [0085.551] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0085.551] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0085.551] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0085.552] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0085.552] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0085.552] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0085.552] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0085.552] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0085.553] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0085.553] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0085.553] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0085.553] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e40 [0085.557] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0085.557] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0085.557] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x5353c0 [0085.580] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0085.580] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0085.580] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0085.581] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0085.582] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a33 [0085.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.582] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.588] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.637] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1a33, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x1a33, lpOverlapped=0x0) returned 1 [0085.702] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x1a40, lpOverlapped=0x0) returned 1 [0085.702] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.717] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.721] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.727] CloseHandle (hObject=0x1a4) returned 1 [0085.728] CloseHandle (hObject=0x1a8) returned 1 [0085.728] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.729] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.729] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535080 [0085.729] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0085.729] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0085.729] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0085.730] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0xffffffff [0085.730] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0085.730] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0085.731] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0085.731] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ec [0085.731] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.732] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.738] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.821] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3ec, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x3ec, lpOverlapped=0x0) returned 1 [0085.835] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x3f0, lpOverlapped=0x0) returned 1 [0085.835] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.850] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.854] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.860] CloseHandle (hObject=0x1a8) returned 1 [0085.860] CloseHandle (hObject=0x1a4) returned 1 [0085.861] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.862] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.862] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535300 [0085.862] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0085.862] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0085.862] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 1 [0085.863] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 0xffffffff [0085.863] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0085.863] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534e80 [0085.876] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.876] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.876] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0085.877] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.877] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.877] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.877] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0085.878] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0085.878] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.878] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.885] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0085.926] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x116, lpOverlapped=0x0) returned 1 [0085.927] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0085.928] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0085.943] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0085.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.953] CloseHandle (hObject=0x1ac) returned 1 [0085.953] CloseHandle (hObject=0x1b0) returned 1 [0085.954] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0085.955] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0085.955] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0085.955] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0085.955] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0085.955] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 1 [0085.956] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0085.956] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0085.956] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0085.956] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0085.956] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0085.956] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.956] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0085.957] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0085.957] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0085.957] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13f [0085.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0085.957] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0085.964] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.008] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x13f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x13f, lpOverlapped=0x0) returned 1 [0086.009] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x140, lpOverlapped=0x0) returned 1 [0086.010] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.025] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.029] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.036] CloseHandle (hObject=0x1b0) returned 1 [0086.036] CloseHandle (hObject=0x1ac) returned 1 [0086.037] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.038] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.038] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0086.038] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.038] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0086.038] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 1 [0086.039] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0086.039] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.039] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0086.039] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.039] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0086.040] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.040] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.040] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.041] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.041] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0086.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.041] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.049] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.092] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x109, lpOverlapped=0x0) returned 1 [0086.093] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0086.094] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.108] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.112] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.118] CloseHandle (hObject=0x1ac) returned 1 [0086.118] CloseHandle (hObject=0x1b0) returned 1 [0086.119] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.120] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.120] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0086.120] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.120] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0086.120] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 1 [0086.121] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0086.121] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.121] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0086.121] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.121] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0086.121] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.121] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.121] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.122] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.122] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0086.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.123] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.129] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.172] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x103, lpOverlapped=0x0) returned 1 [0086.174] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0086.175] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.192] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.196] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.203] CloseHandle (hObject=0x1b0) returned 1 [0086.203] CloseHandle (hObject=0x1ac) returned 1 [0086.204] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.204] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.204] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0086.205] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.205] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0086.205] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 1 [0086.206] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0086.206] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.206] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0086.206] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.206] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0086.208] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.208] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.208] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.208] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.209] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0086.209] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.209] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.216] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.261] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf3, lpOverlapped=0x0) returned 1 [0086.262] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0086.262] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.277] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.281] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.288] CloseHandle (hObject=0x1ac) returned 1 [0086.288] CloseHandle (hObject=0x1b0) returned 1 [0086.288] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.289] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.289] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0086.289] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.289] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0086.289] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 1 [0086.290] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0086.290] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.290] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0086.290] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.290] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0086.290] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.290] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.291] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.291] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.291] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0086.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.291] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.299] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.340] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0086.341] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0086.342] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.357] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.360] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.367] CloseHandle (hObject=0x1b0) returned 1 [0086.367] CloseHandle (hObject=0x1ac) returned 1 [0086.367] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.368] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.368] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0086.368] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.368] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0086.368] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 1 [0086.369] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0086.369] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.369] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0086.369] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.369] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0086.370] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.370] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.371] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.371] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.371] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x149 [0086.371] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.371] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.379] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.422] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x149, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x149, lpOverlapped=0x0) returned 1 [0086.423] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0086.423] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.438] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.441] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.448] CloseHandle (hObject=0x1ac) returned 1 [0086.448] CloseHandle (hObject=0x1b0) returned 1 [0086.449] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.449] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.449] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0086.449] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.449] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0086.450] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 1 [0086.451] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0086.451] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.451] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0086.451] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.451] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0086.451] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.451] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.451] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.451] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.452] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0086.452] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.452] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.458] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.501] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf9, lpOverlapped=0x0) returned 1 [0086.503] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0086.503] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.518] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.522] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.528] CloseHandle (hObject=0x1b0) returned 1 [0086.529] CloseHandle (hObject=0x1ac) returned 1 [0086.529] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.530] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.530] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0086.530] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.530] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0086.530] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0086.531] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0086.531] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.531] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0086.531] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.531] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0086.535] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.535] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.535] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0086.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.536] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.542] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.585] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf9, lpOverlapped=0x0) returned 1 [0086.586] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0086.587] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.609] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.619] CloseHandle (hObject=0x1ac) returned 1 [0086.619] CloseHandle (hObject=0x1b0) returned 1 [0086.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0086.620] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.620] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0086.620] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 1 [0086.621] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0086.621] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.621] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0086.621] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.621] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0086.621] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.621] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.622] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.622] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.622] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0086.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.623] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.629] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.671] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x103, lpOverlapped=0x0) returned 1 [0086.672] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0086.673] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.688] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.691] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.698] CloseHandle (hObject=0x1b0) returned 1 [0086.698] CloseHandle (hObject=0x1ac) returned 1 [0086.699] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.699] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.699] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0086.699] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.699] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0086.699] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 1 [0086.701] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0086.701] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.701] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0086.701] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.701] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0086.702] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.702] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.702] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.702] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.702] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0086.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.703] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.709] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0086.756] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x103, lpOverlapped=0x0) returned 1 [0086.757] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0086.757] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0086.929] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0086.932] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.939] CloseHandle (hObject=0x1ac) returned 1 [0086.939] CloseHandle (hObject=0x1b0) returned 1 [0086.939] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0086.940] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0086.940] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0086.940] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0086.940] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0086.940] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 1 [0086.941] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0086.941] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0086.941] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0086.941] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0086.941] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0086.941] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.941] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0086.942] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0086.942] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0086.942] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0086.942] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0086.942] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0086.949] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.023] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfb, lpOverlapped=0x0) returned 1 [0087.023] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0087.024] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.039] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.042] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.049] CloseHandle (hObject=0x1b0) returned 1 [0087.049] CloseHandle (hObject=0x1ac) returned 1 [0087.050] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.051] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.051] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0087.051] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.051] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0087.051] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 1 [0087.052] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0xffffffff [0087.052] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.052] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0087.052] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.052] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0087.053] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.053] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.054] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.054] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.054] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf3 [0087.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.054] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.061] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.106] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf3, lpOverlapped=0x0) returned 1 [0087.107] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0087.108] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.122] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.126] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.132] CloseHandle (hObject=0x1ac) returned 1 [0087.132] CloseHandle (hObject=0x1b0) returned 1 [0087.133] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.134] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.134] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0087.134] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.134] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0087.134] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 1 [0087.135] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0xffffffff [0087.135] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.135] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0087.135] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.135] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0087.135] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.135] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.136] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.136] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.136] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0087.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.136] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.150] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.207] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x101, lpOverlapped=0x0) returned 1 [0087.208] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0087.209] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.223] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.227] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.235] CloseHandle (hObject=0x1b0) returned 1 [0087.235] CloseHandle (hObject=0x1ac) returned 1 [0087.236] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.236] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.237] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0087.237] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.237] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0087.237] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 1 [0087.238] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0087.238] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.238] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0087.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.238] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0087.243] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.243] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.244] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.244] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.244] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0087.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.244] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.251] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.301] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x104, lpOverlapped=0x0) returned 1 [0087.302] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0087.302] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.317] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.321] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.331] CloseHandle (hObject=0x1ac) returned 1 [0087.331] CloseHandle (hObject=0x1b0) returned 1 [0087.332] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.333] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.333] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0087.333] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.333] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0087.333] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 1 [0087.334] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0087.334] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.334] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0087.334] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.334] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0087.335] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.335] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.335] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.335] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.335] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0087.335] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.336] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.343] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.387] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfc, lpOverlapped=0x0) returned 1 [0087.388] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0087.389] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.404] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.408] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.415] CloseHandle (hObject=0x1b0) returned 1 [0087.415] CloseHandle (hObject=0x1ac) returned 1 [0087.416] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.416] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.417] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0087.417] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.417] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0087.417] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 1 [0087.418] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0087.418] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.418] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0087.418] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.418] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0087.421] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.421] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.421] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.421] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.422] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116 [0087.422] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.422] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.431] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.490] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x116, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x116, lpOverlapped=0x0) returned 1 [0087.491] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0087.491] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.506] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.517] CloseHandle (hObject=0x1ac) returned 1 [0087.518] CloseHandle (hObject=0x1b0) returned 1 [0087.527] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.528] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.528] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0087.528] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.528] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0087.528] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 1 [0087.529] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 0xffffffff [0087.529] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.529] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0087.529] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.529] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0087.529] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.529] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.530] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.530] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.530] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x159 [0087.530] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.531] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.537] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.582] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x159, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x159, lpOverlapped=0x0) returned 1 [0087.582] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x160, lpOverlapped=0x0) returned 1 [0087.583] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.604] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.608] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.615] CloseHandle (hObject=0x1b0) returned 1 [0087.615] CloseHandle (hObject=0x1ac) returned 1 [0087.616] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.616] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.616] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0087.616] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.617] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0087.617] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 1 [0087.617] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0087.618] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.618] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0087.618] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.618] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0087.619] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.619] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.619] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.620] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.620] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107 [0087.620] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.620] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.627] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.672] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x107, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x107, lpOverlapped=0x0) returned 1 [0087.673] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0087.674] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.689] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.699] CloseHandle (hObject=0x1ac) returned 1 [0087.699] CloseHandle (hObject=0x1b0) returned 1 [0087.700] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.701] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.701] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0087.701] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.701] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0087.701] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 1 [0087.702] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0087.702] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.702] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0087.702] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.702] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0087.702] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.702] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.702] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.703] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.703] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0087.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.703] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.710] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.757] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x108, lpOverlapped=0x0) returned 1 [0087.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0087.759] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.774] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.868] CloseHandle (hObject=0x1b0) returned 1 [0087.868] CloseHandle (hObject=0x1ac) returned 1 [0087.869] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.870] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.870] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0087.870] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.870] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0087.870] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 1 [0087.871] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0087.871] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.871] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0087.871] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.871] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0087.872] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.872] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.873] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105 [0087.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.874] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.880] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0087.932] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x105, lpOverlapped=0x0) returned 1 [0087.934] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0087.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0087.949] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0087.953] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.960] CloseHandle (hObject=0x1ac) returned 1 [0087.960] CloseHandle (hObject=0x1b0) returned 1 [0087.961] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0087.961] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0087.961] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0087.961] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0087.961] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0087.961] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 1 [0087.962] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0087.962] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0087.962] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0087.962] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0087.962] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0087.963] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.963] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0087.963] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0087.963] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0087.963] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0087.963] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0087.964] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0087.972] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.017] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x102, lpOverlapped=0x0) returned 1 [0088.018] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0088.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.033] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.044] CloseHandle (hObject=0x1b0) returned 1 [0088.044] CloseHandle (hObject=0x1ac) returned 1 [0088.045] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.045] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.045] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0088.046] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.046] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0088.046] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 1 [0088.047] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0088.047] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.047] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0088.047] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.047] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0088.049] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.049] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.049] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.049] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.050] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0088.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.050] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.057] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.101] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x125, lpOverlapped=0x0) returned 1 [0088.102] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0088.103] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.117] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.121] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.127] CloseHandle (hObject=0x1ac) returned 1 [0088.128] CloseHandle (hObject=0x1b0) returned 1 [0088.128] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.129] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.129] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0088.129] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.129] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0088.129] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 1 [0088.130] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0088.130] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.130] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0088.130] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.130] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0088.130] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.130] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.131] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.131] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.131] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0088.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.139] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.182] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x119, lpOverlapped=0x0) returned 1 [0088.184] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0088.185] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.199] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.209] CloseHandle (hObject=0x1b0) returned 1 [0088.210] CloseHandle (hObject=0x1ac) returned 1 [0088.210] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.211] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0088.211] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.211] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0088.211] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 1 [0088.212] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0088.212] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.212] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0088.212] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.212] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0088.214] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.214] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.214] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.214] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.214] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11d [0088.214] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.215] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.222] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.267] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x11d, lpOverlapped=0x0) returned 1 [0088.268] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0088.268] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.283] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.287] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.293] CloseHandle (hObject=0x1ac) returned 1 [0088.294] CloseHandle (hObject=0x1b0) returned 1 [0088.295] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.295] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.295] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0088.295] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.295] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0088.295] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 1 [0088.296] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0088.296] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.296] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0088.296] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.297] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0088.297] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.297] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.297] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.297] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.297] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0088.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.298] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.304] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.348] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x102, lpOverlapped=0x0) returned 1 [0088.349] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0088.350] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.365] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.368] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.375] CloseHandle (hObject=0x1b0) returned 1 [0088.375] CloseHandle (hObject=0x1ac) returned 1 [0088.376] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.376] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.376] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0088.377] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.377] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0088.377] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 1 [0088.377] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0088.378] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.378] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0088.378] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.378] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0088.379] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.379] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.379] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.379] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.380] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0088.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.380] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.387] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.431] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfe, lpOverlapped=0x0) returned 1 [0088.433] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0088.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.448] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.452] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.458] CloseHandle (hObject=0x1ac) returned 1 [0088.458] CloseHandle (hObject=0x1b0) returned 1 [0088.459] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.459] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.460] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0088.460] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.460] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0088.460] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 1 [0088.461] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0088.461] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.461] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0088.461] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.461] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0088.461] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.461] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.461] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.461] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.462] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0088.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.462] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.469] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.520] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf2, lpOverlapped=0x0) returned 1 [0088.521] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0088.522] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.537] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.541] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.547] CloseHandle (hObject=0x1b0) returned 1 [0088.547] CloseHandle (hObject=0x1ac) returned 1 [0088.548] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.549] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.549] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0088.549] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.549] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0088.549] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 1 [0088.550] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0088.550] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.550] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0088.550] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.550] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0088.552] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.552] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.552] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.553] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.553] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0088.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.553] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.560] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.614] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xda, lpOverlapped=0x0) returned 1 [0088.615] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0088.616] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.633] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.638] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.645] CloseHandle (hObject=0x1ac) returned 1 [0088.645] CloseHandle (hObject=0x1b0) returned 1 [0088.646] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.647] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.647] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0088.647] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.647] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0088.647] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 1 [0088.648] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0088.648] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.648] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0088.648] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.648] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0088.649] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.649] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.649] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.649] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.650] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x101 [0088.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.650] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.657] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.705] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x101, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x101, lpOverlapped=0x0) returned 1 [0088.706] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0088.707] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.722] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.726] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.734] CloseHandle (hObject=0x1b0) returned 1 [0088.734] CloseHandle (hObject=0x1ac) returned 1 [0088.735] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.735] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.735] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0088.735] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.736] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0088.736] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 1 [0088.737] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0088.737] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.737] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0088.737] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.737] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0088.738] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.738] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.738] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.738] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.739] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6 [0088.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.739] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.746] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.889] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf6, lpOverlapped=0x0) returned 1 [0088.893] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0088.893] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0088.909] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0088.913] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.920] CloseHandle (hObject=0x1ac) returned 1 [0088.920] CloseHandle (hObject=0x1b0) returned 1 [0088.921] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0088.922] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0088.922] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0088.922] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0088.922] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0088.922] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0088.923] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0088.923] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0088.923] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0088.923] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0088.923] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0088.924] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.924] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0088.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0088.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0088.924] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0088.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0088.925] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0088.932] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0088.991] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x108, lpOverlapped=0x0) returned 1 [0088.992] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0088.993] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.012] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.015] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.022] CloseHandle (hObject=0x1b0) returned 1 [0089.023] CloseHandle (hObject=0x1ac) returned 1 [0089.023] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.024] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.024] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0089.024] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.024] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0089.024] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0089.025] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0089.025] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.025] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0089.025] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.025] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0089.026] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.026] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.027] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.027] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.027] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0089.027] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.027] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.034] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.081] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x119, lpOverlapped=0x0) returned 1 [0089.081] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0089.082] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.097] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.101] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.107] CloseHandle (hObject=0x1ac) returned 1 [0089.108] CloseHandle (hObject=0x1b0) returned 1 [0089.108] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.109] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.109] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0089.109] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.109] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0089.109] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 1 [0089.110] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0089.110] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.158] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0089.158] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.158] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0089.159] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.159] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.159] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.159] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.160] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x152 [0089.160] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.160] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.166] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.212] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x152, lpOverlapped=0x0) returned 1 [0089.213] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x160, lpOverlapped=0x0) returned 1 [0089.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.228] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.239] CloseHandle (hObject=0x1b0) returned 1 [0089.239] CloseHandle (hObject=0x1ac) returned 1 [0089.240] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.241] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.241] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0089.241] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.241] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0089.241] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 1 [0089.242] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0089.242] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.242] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0089.242] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.242] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0089.244] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.244] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.244] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.245] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.245] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0089.245] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.245] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.252] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.297] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x112, lpOverlapped=0x0) returned 1 [0089.298] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0089.298] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.314] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.318] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.324] CloseHandle (hObject=0x1ac) returned 1 [0089.324] CloseHandle (hObject=0x1b0) returned 1 [0089.325] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.326] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.326] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0089.326] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.326] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0089.326] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 1 [0089.327] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0089.327] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.327] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0089.327] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.327] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0089.327] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.327] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.327] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.328] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.328] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0089.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.328] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.346] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.399] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10c, lpOverlapped=0x0) returned 1 [0089.400] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0089.401] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.416] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.419] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.427] CloseHandle (hObject=0x1b0) returned 1 [0089.427] CloseHandle (hObject=0x1ac) returned 1 [0089.428] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.428] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.428] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0089.429] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.429] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0089.429] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 1 [0089.429] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0089.430] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.430] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0089.430] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.430] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0089.431] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.431] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.431] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.432] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.432] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f [0089.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.432] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.439] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.484] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x11f, lpOverlapped=0x0) returned 1 [0089.485] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0089.486] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.501] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.505] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.512] CloseHandle (hObject=0x1ac) returned 1 [0089.512] CloseHandle (hObject=0x1b0) returned 1 [0089.513] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.513] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.513] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0089.514] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.514] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0089.514] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 1 [0089.515] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0089.515] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.515] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0089.515] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.515] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0089.515] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.515] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.515] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.515] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.516] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0089.516] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.516] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.527] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.575] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfd, lpOverlapped=0x0) returned 1 [0089.575] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0089.576] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.591] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.594] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.601] CloseHandle (hObject=0x1b0) returned 1 [0089.601] CloseHandle (hObject=0x1ac) returned 1 [0089.602] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.603] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.603] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0089.603] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.603] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0089.603] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 1 [0089.604] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0089.604] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.604] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0089.604] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.604] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0089.611] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.611] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.612] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.612] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.612] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x164 [0089.612] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.613] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.619] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.665] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x164, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x164, lpOverlapped=0x0) returned 1 [0089.666] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x170, lpOverlapped=0x0) returned 1 [0089.667] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.682] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.686] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.692] CloseHandle (hObject=0x1ac) returned 1 [0089.692] CloseHandle (hObject=0x1b0) returned 1 [0089.693] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.693] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.693] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0089.694] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.694] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0089.694] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 1 [0089.695] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0089.695] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.695] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0089.695] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.695] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0089.695] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.695] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.696] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10e [0089.696] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.696] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.704] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.749] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10e, lpOverlapped=0x0) returned 1 [0089.750] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0089.751] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.766] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.770] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.776] CloseHandle (hObject=0x1b0) returned 1 [0089.776] CloseHandle (hObject=0x1ac) returned 1 [0089.860] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.861] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.861] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0089.861] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.861] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0089.861] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 1 [0089.862] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0089.862] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.862] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0089.862] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.862] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0089.863] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.863] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.864] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.864] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.864] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x161 [0089.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.864] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.871] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0089.917] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x161, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x161, lpOverlapped=0x0) returned 1 [0089.917] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x170, lpOverlapped=0x0) returned 1 [0089.918] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0089.933] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0089.936] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.943] CloseHandle (hObject=0x1ac) returned 1 [0089.943] CloseHandle (hObject=0x1b0) returned 1 [0089.944] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0089.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0089.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0089.944] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0089.944] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0089.945] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 1 [0089.945] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0089.945] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0089.945] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0089.945] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0089.946] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0089.946] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.946] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0089.946] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0089.946] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0089.946] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x117 [0089.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0089.947] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0089.954] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.000] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x117, lpOverlapped=0x0) returned 1 [0090.001] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0090.001] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.016] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.020] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.027] CloseHandle (hObject=0x1b0) returned 1 [0090.027] CloseHandle (hObject=0x1ac) returned 1 [0090.028] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.029] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.029] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0090.029] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0090.029] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0090.029] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 1 [0090.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0090.030] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0090.030] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0090.030] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.030] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0090.031] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.031] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0090.032] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0090.032] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111 [0090.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.032] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.039] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.086] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x111, lpOverlapped=0x0) returned 1 [0090.087] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0090.088] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.103] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.107] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.113] CloseHandle (hObject=0x1ac) returned 1 [0090.114] CloseHandle (hObject=0x1b0) returned 1 [0090.114] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.115] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.115] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0090.115] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0090.115] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0090.115] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0090.116] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0090.116] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0090.116] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0090.116] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.116] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0090.117] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.117] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.117] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0090.117] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0090.117] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0090.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.118] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.125] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.174] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10b, lpOverlapped=0x0) returned 1 [0090.175] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0090.176] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.191] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.195] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.201] CloseHandle (hObject=0x1b0) returned 1 [0090.202] CloseHandle (hObject=0x1ac) returned 1 [0090.202] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.203] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.203] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0090.203] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0090.203] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0090.203] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0090.204] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0090.204] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0090.204] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0090.205] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0090.205] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0090.205] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0090.205] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535040 [0090.207] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.207] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.207] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0090.207] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0090.216] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bd5 [0090.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.217] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.223] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.280] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2bd5, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2bd5, lpOverlapped=0x0) returned 1 [0090.289] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2be0, lpOverlapped=0x0) returned 1 [0090.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.354] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.359] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.366] CloseHandle (hObject=0x1a8) returned 1 [0090.366] CloseHandle (hObject=0x1ac) returned 1 [0090.367] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.367] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.367] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534cc0 [0090.367] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0090.367] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0090.368] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 1 [0090.368] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0090.368] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0090.369] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0090.369] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0090.369] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0090.369] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0090.369] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0090.371] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0090.371] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e80 [0090.371] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0090.371] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0090.371] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x5353c0 [0090.426] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0090.426] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0090.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0090.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0090.427] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4e [0090.427] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.427] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.434] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.479] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd4e, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xd4e, lpOverlapped=0x0) returned 1 [0090.480] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xd50, lpOverlapped=0x0) returned 1 [0090.481] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.496] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.499] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.506] CloseHandle (hObject=0x1a4) returned 1 [0090.506] CloseHandle (hObject=0x1ac) returned 1 [0090.506] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.509] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.509] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5351c0 [0090.509] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0090.509] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0090.509] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0090.510] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0xffffffff [0090.510] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0090.510] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0090.511] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0090.511] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d8 [0090.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.512] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.519] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.567] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2d8, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x2d8, lpOverlapped=0x0) returned 1 [0090.578] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x2e0, lpOverlapped=0x0) returned 1 [0090.579] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.595] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.598] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.612] CloseHandle (hObject=0x1ac) returned 1 [0090.612] CloseHandle (hObject=0x1a4) returned 1 [0090.613] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.613] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.613] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0090.613] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0090.613] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0090.613] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 1 [0090.614] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 0xffffffff [0090.614] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0090.614] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534d00 [0090.625] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.625] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0090.625] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.625] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.626] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0090.626] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0090.626] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0090.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.627] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.633] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.679] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0090.680] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0090.681] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.696] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.700] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.706] CloseHandle (hObject=0x1a8) returned 1 [0090.707] CloseHandle (hObject=0x1b0) returned 1 [0090.707] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.708] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.708] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0090.708] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0090.708] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0090.708] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 1 [0090.709] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0090.709] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0090.709] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0090.709] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.709] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0090.710] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.710] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.710] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0090.711] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0090.711] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0090.711] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.712] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.719] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.764] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0090.765] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0090.766] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.875] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.878] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.885] CloseHandle (hObject=0x1b0) returned 1 [0090.885] CloseHandle (hObject=0x1a8) returned 1 [0090.886] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.887] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.887] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0090.887] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0090.887] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0090.887] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 1 [0090.888] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0090.888] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0090.888] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0090.888] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.888] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0090.888] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.888] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.889] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0090.889] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0090.889] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0090.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.889] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.896] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0090.941] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0090.942] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0090.943] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0090.957] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0090.961] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.968] CloseHandle (hObject=0x1a8) returned 1 [0090.968] CloseHandle (hObject=0x1b0) returned 1 [0090.968] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0090.969] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0090.969] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0090.969] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0090.969] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0090.969] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 1 [0090.970] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0090.970] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0090.970] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0090.970] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0090.970] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0090.970] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.970] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0090.970] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0090.971] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0090.973] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0090.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0090.973] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0090.979] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.024] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.025] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.040] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.044] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.050] CloseHandle (hObject=0x1b0) returned 1 [0091.050] CloseHandle (hObject=0x1a8) returned 1 [0091.051] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.051] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.051] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0091.051] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.052] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0091.052] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 1 [0091.053] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0091.053] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.053] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0091.053] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.053] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0091.053] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.053] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.053] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.053] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.054] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.054] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.054] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.062] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.109] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.110] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.110] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.125] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.129] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.135] CloseHandle (hObject=0x1a8) returned 1 [0091.135] CloseHandle (hObject=0x1b0) returned 1 [0091.136] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.137] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.137] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0091.137] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.137] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.137] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 1 [0091.138] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0xffffffff [0091.138] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.138] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0091.138] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.138] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0091.138] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.138] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.138] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.139] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.140] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.140] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.147] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.194] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.196] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.212] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.216] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.222] CloseHandle (hObject=0x1b0) returned 1 [0091.222] CloseHandle (hObject=0x1a8) returned 1 [0091.223] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.223] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.223] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0091.223] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.223] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0091.224] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 1 [0091.225] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0xffffffff [0091.225] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.225] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.225] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.225] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0091.225] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.225] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.226] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.226] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.226] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.226] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.234] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.280] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.280] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.281] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.298] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.302] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.309] CloseHandle (hObject=0x1a8) returned 1 [0091.310] CloseHandle (hObject=0x1b0) returned 1 [0091.310] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.311] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.311] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0091.311] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.311] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0091.311] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 1 [0091.312] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 0xffffffff [0091.312] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.312] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.312] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.312] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0091.312] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.312] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.312] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.315] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.315] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.315] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.315] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.322] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.377] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.378] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.379] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.395] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.407] CloseHandle (hObject=0x1b0) returned 1 [0091.407] CloseHandle (hObject=0x1a8) returned 1 [0091.408] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0091.409] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.409] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0091.409] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 1 [0091.410] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 0xffffffff [0091.410] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.410] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0091.410] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.410] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0091.410] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.410] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.411] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.411] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.411] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.419] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.469] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.470] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.471] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.488] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.492] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.501] CloseHandle (hObject=0x1a8) returned 1 [0091.501] CloseHandle (hObject=0x1b0) returned 1 [0091.501] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.502] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0091.502] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.502] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.502] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 1 [0091.503] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0xffffffff [0091.503] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.503] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0091.503] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.503] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0091.504] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.504] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.504] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.505] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.506] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.506] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.513] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.659] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.659] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.660] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.676] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.680] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.702] CloseHandle (hObject=0x1b0) returned 1 [0091.702] CloseHandle (hObject=0x1a8) returned 1 [0091.702] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.703] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0091.703] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.703] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.703] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 1 [0091.704] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0091.704] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.704] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0091.704] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.705] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0091.705] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.705] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.705] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.705] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.706] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.706] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.706] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.713] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.760] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.761] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.762] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.795] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.799] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.805] CloseHandle (hObject=0x1a8) returned 1 [0091.806] CloseHandle (hObject=0x1b0) returned 1 [0091.806] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0091.807] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.807] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0091.807] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 1 [0091.808] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0091.808] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.808] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.808] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.808] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0091.808] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.808] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.810] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.810] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.811] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.864] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.865] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.866] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.883] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.887] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.894] CloseHandle (hObject=0x1b0) returned 1 [0091.894] CloseHandle (hObject=0x1a8) returned 1 [0091.894] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.895] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.895] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0091.895] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.895] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0091.895] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 1 [0091.896] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0091.896] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.896] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0091.896] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.896] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0091.897] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.897] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.897] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.897] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.897] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.897] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.898] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.905] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0091.952] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0091.953] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0091.954] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0091.970] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0091.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.982] CloseHandle (hObject=0x1a8) returned 1 [0091.982] CloseHandle (hObject=0x1b0) returned 1 [0091.983] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0091.983] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0091.983] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0091.983] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0091.983] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0091.984] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 1 [0091.984] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 0xffffffff [0091.985] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0091.985] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0091.985] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0091.985] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0091.985] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.985] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0091.985] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0091.986] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0091.987] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0091.987] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0091.987] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0091.994] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.039] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.040] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.041] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.056] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.060] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.067] CloseHandle (hObject=0x1b0) returned 1 [0092.067] CloseHandle (hObject=0x1a8) returned 1 [0092.067] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.068] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.068] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0092.068] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.068] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0092.068] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 1 [0092.069] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0092.069] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.069] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0092.069] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.069] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0092.070] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.070] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.070] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.070] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.070] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.070] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.071] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.078] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.123] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.123] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.124] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.139] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.143] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.151] CloseHandle (hObject=0x1a8) returned 1 [0092.151] CloseHandle (hObject=0x1b0) returned 1 [0092.152] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.152] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.153] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0092.153] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.153] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0092.153] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 1 [0092.154] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0092.154] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.154] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0092.154] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.154] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0092.154] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.154] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.154] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.156] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.156] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.156] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.164] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.210] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.211] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.212] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.227] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.231] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.237] CloseHandle (hObject=0x1b0) returned 1 [0092.237] CloseHandle (hObject=0x1a8) returned 1 [0092.238] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.238] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.238] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0092.238] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.238] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0092.238] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 1 [0092.239] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0092.239] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.239] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0092.239] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.239] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0092.240] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.240] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.240] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.240] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.240] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.240] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.240] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.248] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.296] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.296] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.297] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.317] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.323] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.329] CloseHandle (hObject=0x1a8) returned 1 [0092.329] CloseHandle (hObject=0x1b0) returned 1 [0092.330] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.330] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0092.330] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.330] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0092.331] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 1 [0092.331] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 0xffffffff [0092.331] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.331] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0092.332] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.332] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0092.332] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.332] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.332] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.334] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.334] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.334] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.334] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.341] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.391] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.391] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.407] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.411] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.419] CloseHandle (hObject=0x1b0) returned 1 [0092.419] CloseHandle (hObject=0x1a8) returned 1 [0092.419] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.420] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.420] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0092.420] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.420] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0092.420] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 1 [0092.421] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 0xffffffff [0092.421] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.421] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0092.421] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.421] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0092.421] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.421] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.422] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.422] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.423] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.424] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.430] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.472] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.473] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.489] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.492] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.499] CloseHandle (hObject=0x1a8) returned 1 [0092.499] CloseHandle (hObject=0x1b0) returned 1 [0092.499] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.500] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.500] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0092.500] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.500] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0092.500] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 1 [0092.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0092.501] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.501] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0092.501] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.501] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0092.501] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.501] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.503] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.503] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.503] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.503] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.510] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.554] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.555] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.556] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.571] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.575] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.581] CloseHandle (hObject=0x1b0) returned 1 [0092.582] CloseHandle (hObject=0x1a8) returned 1 [0092.582] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.583] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.583] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0092.583] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.583] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0092.583] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 1 [0092.584] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0092.585] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.585] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0092.585] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.585] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0092.585] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.585] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.586] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.586] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.586] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.587] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.597] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.659] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.660] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.661] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.728] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.735] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.742] CloseHandle (hObject=0x1a8) returned 1 [0092.742] CloseHandle (hObject=0x1b0) returned 1 [0092.743] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.743] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.743] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0092.743] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.744] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0092.744] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 1 [0092.744] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0092.744] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.744] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0092.745] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.745] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0092.745] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.745] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.745] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.746] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.747] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.747] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.754] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.899] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0092.900] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0092.901] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0092.915] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0092.932] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.941] CloseHandle (hObject=0x1b0) returned 1 [0092.941] CloseHandle (hObject=0x1a8) returned 1 [0092.942] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0092.943] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0092.943] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0092.943] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0092.943] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0092.943] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 1 [0092.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0092.944] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0092.944] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0092.944] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0092.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0092.945] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.945] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0092.945] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0092.945] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0092.945] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0092.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0092.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0092.952] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0092.998] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.009] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.010] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.024] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.028] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.035] CloseHandle (hObject=0x1a8) returned 1 [0093.035] CloseHandle (hObject=0x1b0) returned 1 [0093.035] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.036] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.036] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0093.036] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.036] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0093.036] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 1 [0093.037] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0093.037] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.037] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0093.037] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.037] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0093.037] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.037] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.037] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.039] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.039] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f [0093.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.039] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.054] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.097] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x9f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x9f, lpOverlapped=0x0) returned 1 [0093.098] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xa0, lpOverlapped=0x0) returned 1 [0093.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.113] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.117] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.124] CloseHandle (hObject=0x1b0) returned 1 [0093.124] CloseHandle (hObject=0x1a8) returned 1 [0093.125] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.125] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.125] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0093.125] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.125] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0093.125] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 1 [0093.126] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 0xffffffff [0093.126] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.126] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0093.126] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0093.127] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.127] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.127] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.127] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.127] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.128] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.134] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.176] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.181] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.197] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.207] CloseHandle (hObject=0x1a8) returned 1 [0093.207] CloseHandle (hObject=0x1b0) returned 1 [0093.208] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.208] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.208] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0093.208] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.208] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0093.208] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 1 [0093.209] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0093.209] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.209] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0093.209] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0093.210] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.210] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.210] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.211] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.212] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.212] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.221] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.262] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.263] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.263] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.279] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.293] CloseHandle (hObject=0x1b0) returned 1 [0093.293] CloseHandle (hObject=0x1a8) returned 1 [0093.293] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.294] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.294] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0093.294] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.294] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0093.294] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 1 [0093.295] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0093.295] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.295] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0093.295] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.295] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0093.295] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.295] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.295] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.296] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.296] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.296] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.303] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.351] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.353] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.353] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.368] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.378] CloseHandle (hObject=0x1a8) returned 1 [0093.378] CloseHandle (hObject=0x1b0) returned 1 [0093.379] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.379] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.379] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0093.379] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.379] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0093.380] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 1 [0093.380] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0093.380] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.380] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0093.381] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.381] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0093.381] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.381] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.381] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.382] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.382] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.382] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.390] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.431] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.432] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.449] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.452] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.459] CloseHandle (hObject=0x1b0) returned 1 [0093.459] CloseHandle (hObject=0x1a8) returned 1 [0093.460] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.460] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.460] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0093.460] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.460] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0093.461] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 1 [0093.461] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0093.461] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.461] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0093.462] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.462] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0093.462] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.462] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.462] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.462] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.462] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.463] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.470] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.512] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.513] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.514] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.530] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.541] CloseHandle (hObject=0x1a8) returned 1 [0093.541] CloseHandle (hObject=0x1b0) returned 1 [0093.541] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.542] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.542] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0093.542] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.542] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0093.542] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 1 [0093.544] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0093.544] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.544] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0093.544] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.544] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0093.544] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.545] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.546] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.547] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.547] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.554] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.598] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.599] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.599] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.624] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.628] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.634] CloseHandle (hObject=0x1b0) returned 1 [0093.634] CloseHandle (hObject=0x1a8) returned 1 [0093.635] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.635] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.635] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0093.635] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.635] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0093.635] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 1 [0093.636] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0093.636] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.636] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0093.636] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.636] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0093.637] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.637] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.637] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.637] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.638] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.645] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.697] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.698] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.719] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.724] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.730] CloseHandle (hObject=0x1a8) returned 1 [0093.731] CloseHandle (hObject=0x1b0) returned 1 [0093.731] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.732] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.732] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0093.732] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.732] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0093.732] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 1 [0093.733] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0093.733] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.733] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0093.733] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.733] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0093.733] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.733] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.734] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.735] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.736] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.736] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.743] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0093.927] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0093.927] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0093.928] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0093.944] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0093.947] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.954] CloseHandle (hObject=0x1b0) returned 1 [0093.954] CloseHandle (hObject=0x1a8) returned 1 [0093.955] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0093.955] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0093.956] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0093.956] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0093.956] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0093.956] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 1 [0093.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0093.957] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0093.957] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0093.957] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0093.957] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0093.957] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.957] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0093.957] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0093.958] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0093.958] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0093.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0093.958] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0093.965] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.013] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.014] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.015] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.031] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.035] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.041] CloseHandle (hObject=0x1a8) returned 1 [0094.041] CloseHandle (hObject=0x1b0) returned 1 [0094.042] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.042] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.042] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0094.042] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.042] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0094.042] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 1 [0094.043] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0094.043] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.043] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0094.044] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.044] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0094.044] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.044] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.044] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.045] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0094.045] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0094.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.046] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.053] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.095] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.124] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.124] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.139] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.143] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.149] CloseHandle (hObject=0x1b0) returned 1 [0094.149] CloseHandle (hObject=0x1a8) returned 1 [0094.150] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.150] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.150] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0094.150] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.150] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0094.151] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 1 [0094.151] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0xffffffff [0094.151] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.151] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0094.152] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.152] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0094.152] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.152] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.152] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0094.152] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.153] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0094.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.153] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.160] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.216] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.217] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.233] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.237] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.243] CloseHandle (hObject=0x1a8) returned 1 [0094.243] CloseHandle (hObject=0x1b0) returned 1 [0094.244] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.244] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.244] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0094.245] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.245] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0094.245] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 1 [0094.245] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0094.246] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.246] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0094.246] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.246] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0094.246] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.246] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.246] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.248] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0094.249] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0094.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.249] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.257] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.302] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.303] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.304] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.319] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.323] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.330] CloseHandle (hObject=0x1b0) returned 1 [0094.330] CloseHandle (hObject=0x1a8) returned 1 [0094.331] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.332] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.332] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0094.332] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.332] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0094.332] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 1 [0094.333] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0094.333] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.333] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0094.334] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.334] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0094.334] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.334] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.334] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0094.334] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.335] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0094.335] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.335] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.343] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.386] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.388] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.389] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.406] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.410] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.416] CloseHandle (hObject=0x1a8) returned 1 [0094.416] CloseHandle (hObject=0x1b0) returned 1 [0094.417] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.417] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.417] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0094.417] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.417] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0094.417] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 1 [0094.418] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0094.418] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.418] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0094.418] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.418] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0094.418] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.419] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.419] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.420] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0094.423] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0094.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.424] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.431] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.475] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.475] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.476] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.491] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.501] CloseHandle (hObject=0x1b0) returned 1 [0094.501] CloseHandle (hObject=0x1a8) returned 1 [0094.502] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.502] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0094.502] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.502] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0094.502] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 1 [0094.503] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0094.503] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.503] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0094.503] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.504] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0094.504] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.504] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0094.504] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0094.504] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.504] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0094.505] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.505] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.511] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.554] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0094.557] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0094.557] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.573] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.577] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.586] CloseHandle (hObject=0x1a8) returned 1 [0094.586] CloseHandle (hObject=0x1b0) returned 1 [0094.587] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.587] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.587] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0094.587] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0094.588] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0094.588] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 1 [0094.588] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0094.589] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0094.589] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0094.589] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0094.589] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0094.589] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0094.589] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535080 [0094.589] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.589] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0094.589] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0094.591] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.592] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2769 [0094.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.593] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.600] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.649] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2769, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2769, lpOverlapped=0x0) returned 1 [0094.659] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2770, lpOverlapped=0x0) returned 1 [0094.660] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.675] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.678] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.684] CloseHandle (hObject=0x1ac) returned 1 [0094.685] CloseHandle (hObject=0x1b0) returned 1 [0094.685] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.686] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.686] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534cc0 [0094.686] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0094.686] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0094.686] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 1 [0094.687] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0094.687] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0094.687] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0094.687] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0094.687] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0094.688] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0094.688] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0094.688] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0094.688] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535300 [0094.690] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0094.690] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0094.690] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x535040 [0094.707] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0094.707] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0094.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0094.709] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.709] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd47 [0094.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.709] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.716] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.758] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd47, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xd47, lpOverlapped=0x0) returned 1 [0094.759] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xd50, lpOverlapped=0x0) returned 1 [0094.759] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.774] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.865] CloseHandle (hObject=0x1a4) returned 1 [0094.865] CloseHandle (hObject=0x1b0) returned 1 [0094.866] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.867] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.867] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535080 [0094.867] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0094.867] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0094.867] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0094.868] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0xffffffff [0094.868] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0094.868] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.871] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0094.871] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9d [0094.871] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.871] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.879] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.921] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x9d, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x9d, lpOverlapped=0x0) returned 1 [0094.922] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xa0, lpOverlapped=0x0) returned 1 [0094.922] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0094.937] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0094.941] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.947] CloseHandle (hObject=0x1b0) returned 1 [0094.947] CloseHandle (hObject=0x1a4) returned 1 [0094.948] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0094.949] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0094.949] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5351c0 [0094.949] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0094.949] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0094.949] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0094.950] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0xffffffff [0094.950] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0094.950] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0094.950] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0094.950] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0094.950] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0094.951] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0094.958] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0094.999] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5c, lpOverlapped=0x0) returned 1 [0095.002] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0095.003] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.018] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.021] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.027] CloseHandle (hObject=0x1a4) returned 1 [0095.028] CloseHandle (hObject=0x1b0) returned 1 [0095.028] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.029] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.029] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0095.029] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0095.029] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0095.029] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1 [0095.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 0xffffffff [0095.030] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0095.030] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0095.030] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0095.030] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f [0095.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.031] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.038] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.152] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5f, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5f, lpOverlapped=0x0) returned 1 [0095.152] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0095.153] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.168] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.171] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.178] CloseHandle (hObject=0x1b0) returned 1 [0095.178] CloseHandle (hObject=0x1a4) returned 1 [0095.179] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.179] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.179] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534e40 [0095.179] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0095.179] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0095.180] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1 [0095.180] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 0xffffffff [0095.180] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0095.181] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0095.181] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0095.181] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d6 [0095.181] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.181] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.188] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.230] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2d6, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x2d6, lpOverlapped=0x0) returned 1 [0095.242] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x2e0, lpOverlapped=0x0) returned 1 [0095.243] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.259] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.263] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.269] CloseHandle (hObject=0x1a4) returned 1 [0095.270] CloseHandle (hObject=0x1b0) returned 1 [0095.270] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.271] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.271] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5351c0 [0095.271] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0095.271] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0095.271] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 1 [0095.272] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 0xffffffff [0095.272] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0095.272] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534cc0 [0095.284] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.284] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.284] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0095.284] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.284] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.285] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.286] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.286] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0095.286] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.287] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.293] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.340] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfe, lpOverlapped=0x0) returned 1 [0095.342] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0095.342] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.357] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.361] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.368] CloseHandle (hObject=0x1ac) returned 1 [0095.368] CloseHandle (hObject=0x1a8) returned 1 [0095.369] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.369] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.369] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0095.369] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.369] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0095.369] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 1 [0095.370] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0095.370] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.370] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0095.371] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.371] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0095.371] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.371] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.371] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.371] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.371] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f [0095.371] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.372] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.380] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.422] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x12f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x12f, lpOverlapped=0x0) returned 1 [0095.425] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0095.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.440] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.444] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.450] CloseHandle (hObject=0x1a8) returned 1 [0095.450] CloseHandle (hObject=0x1ac) returned 1 [0095.451] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.452] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.452] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0095.452] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.452] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0095.452] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 1 [0095.453] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0095.453] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.453] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0095.453] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.453] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0095.454] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.454] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.454] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.455] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.456] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0095.456] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.456] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.463] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.525] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe5, lpOverlapped=0x0) returned 1 [0095.528] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0095.529] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.545] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.552] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.559] CloseHandle (hObject=0x1ac) returned 1 [0095.559] CloseHandle (hObject=0x1a8) returned 1 [0095.560] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.561] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0095.561] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.561] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0095.561] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 1 [0095.562] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0095.562] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.562] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0095.562] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.562] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0095.562] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.562] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.563] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.563] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.565] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0095.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.565] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.572] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.619] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xda, lpOverlapped=0x0) returned 1 [0095.619] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0095.620] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.635] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.638] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.645] CloseHandle (hObject=0x1a8) returned 1 [0095.645] CloseHandle (hObject=0x1ac) returned 1 [0095.646] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.647] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0095.647] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.647] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0095.647] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 1 [0095.648] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0095.648] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.648] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0095.648] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.648] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0095.648] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.648] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.648] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.649] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.650] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0095.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.650] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.656] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.699] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcf, lpOverlapped=0x0) returned 1 [0095.700] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0095.701] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.715] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.719] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.726] CloseHandle (hObject=0x1ac) returned 1 [0095.726] CloseHandle (hObject=0x1a8) returned 1 [0095.727] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.727] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.727] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0095.727] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.727] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0095.727] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 1 [0095.728] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0095.728] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.728] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0095.728] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.728] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0095.729] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.729] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.729] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.729] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.729] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0095.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.730] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.737] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.778] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdc, lpOverlapped=0x0) returned 1 [0095.779] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0095.780] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.865] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.869] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.875] CloseHandle (hObject=0x1a8) returned 1 [0095.875] CloseHandle (hObject=0x1ac) returned 1 [0095.877] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.877] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.877] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0095.877] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.877] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0095.877] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 1 [0095.878] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0095.878] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.878] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0095.878] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.878] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0095.878] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.879] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.879] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.880] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.880] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0095.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.881] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.887] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0095.929] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0095.930] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x140, lpOverlapped=0x0) returned 1 [0095.931] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0095.945] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0095.949] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.956] CloseHandle (hObject=0x1ac) returned 1 [0095.956] CloseHandle (hObject=0x1a8) returned 1 [0095.957] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0095.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0095.957] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0095.957] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0095.958] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0095.958] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 1 [0095.958] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0095.958] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0095.958] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0095.959] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0095.959] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0095.959] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.959] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0095.959] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0095.959] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0095.959] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0095.960] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0095.960] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0095.966] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.010] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0096.012] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.026] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.030] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.037] CloseHandle (hObject=0x1a8) returned 1 [0096.037] CloseHandle (hObject=0x1ac) returned 1 [0096.038] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.038] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.038] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0096.038] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.038] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0096.038] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0096.039] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0096.039] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.039] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0096.039] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.039] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0096.040] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.040] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.040] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.045] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.045] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0096.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.046] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.052] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.098] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0096.098] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0096.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.115] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.118] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.125] CloseHandle (hObject=0x1ac) returned 1 [0096.125] CloseHandle (hObject=0x1a8) returned 1 [0096.125] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.126] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0096.126] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.126] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0096.126] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 1 [0096.127] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0096.127] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.127] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0096.128] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0096.128] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.128] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.128] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.128] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.128] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0096.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.129] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.136] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.181] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe5, lpOverlapped=0x0) returned 1 [0096.182] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0096.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.198] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.208] CloseHandle (hObject=0x1a8) returned 1 [0096.209] CloseHandle (hObject=0x1ac) returned 1 [0096.210] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.210] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.210] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0096.210] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.210] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0096.210] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 1 [0096.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0096.211] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.211] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0096.211] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.212] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0096.212] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.212] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.212] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.213] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.213] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0096.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.214] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.220] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.264] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe5, lpOverlapped=0x0) returned 1 [0096.265] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0096.265] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.280] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.290] CloseHandle (hObject=0x1ac) returned 1 [0096.291] CloseHandle (hObject=0x1a8) returned 1 [0096.291] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.291] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.291] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0096.292] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.292] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0096.292] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 1 [0096.292] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0096.293] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.293] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0096.293] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.293] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0096.293] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.293] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.293] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.293] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.294] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0096.294] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.294] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.301] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.342] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe2, lpOverlapped=0x0) returned 1 [0096.344] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0096.345] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.360] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.364] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.370] CloseHandle (hObject=0x1a8) returned 1 [0096.371] CloseHandle (hObject=0x1ac) returned 1 [0096.371] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.372] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.372] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0096.372] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.372] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0096.372] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 1 [0096.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 0xffffffff [0096.373] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.373] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0096.373] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.373] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0096.373] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.374] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.374] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.375] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.375] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdc [0096.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.375] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.383] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.427] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdc, lpOverlapped=0x0) returned 1 [0096.428] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0096.428] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.443] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.447] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.453] CloseHandle (hObject=0x1ac) returned 1 [0096.453] CloseHandle (hObject=0x1a8) returned 1 [0096.454] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.455] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0096.455] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.455] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0096.455] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 1 [0096.456] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0096.456] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.456] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0096.459] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.459] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0096.460] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.460] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.460] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.460] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.460] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0096.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.461] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.467] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.509] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdf, lpOverlapped=0x0) returned 1 [0096.510] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0096.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.529] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.536] CloseHandle (hObject=0x1a8) returned 1 [0096.536] CloseHandle (hObject=0x1ac) returned 1 [0096.537] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.538] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0096.538] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.538] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0096.538] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 1 [0096.539] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0096.539] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.539] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0096.539] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.539] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0096.539] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.539] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.540] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.541] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.541] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0096.541] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.541] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.548] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.619] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe2, lpOverlapped=0x0) returned 1 [0096.620] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0096.621] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.636] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.641] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.652] CloseHandle (hObject=0x1ac) returned 1 [0096.652] CloseHandle (hObject=0x1a8) returned 1 [0096.653] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.654] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.654] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0096.654] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.654] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0096.654] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 1 [0096.655] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0096.655] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.655] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0096.656] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.656] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0096.656] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.656] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.656] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.656] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.657] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee [0096.657] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.657] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.668] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.712] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xee, lpOverlapped=0x0) returned 1 [0096.713] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0096.714] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.729] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.740] CloseHandle (hObject=0x1a8) returned 1 [0096.741] CloseHandle (hObject=0x1ac) returned 1 [0096.742] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.742] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.742] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0096.742] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.742] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0096.743] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 1 [0096.743] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 0xffffffff [0096.744] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.744] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0096.744] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.744] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0096.744] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.744] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.744] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.746] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.746] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0096.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.747] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.754] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.796] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x11a, lpOverlapped=0x0) returned 1 [0096.797] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0096.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.813] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0096.817] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.823] CloseHandle (hObject=0x1ac) returned 1 [0096.824] CloseHandle (hObject=0x1a8) returned 1 [0096.825] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0096.825] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0096.825] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0096.825] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0096.825] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0096.826] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 1 [0096.827] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0096.827] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0096.827] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0096.827] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0096.827] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0096.827] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.827] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0096.827] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0096.827] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0096.828] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0096.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0096.828] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0096.932] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0096.980] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xeb, lpOverlapped=0x0) returned 1 [0096.981] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0096.981] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0096.996] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.000] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.006] CloseHandle (hObject=0x1a8) returned 1 [0097.007] CloseHandle (hObject=0x1ac) returned 1 [0097.007] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.008] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.008] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0097.008] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.008] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0097.008] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 1 [0097.009] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0097.009] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.009] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0097.009] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.009] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0097.011] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.011] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.011] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.012] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.012] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0097.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.012] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.019] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.060] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd8, lpOverlapped=0x0) returned 1 [0097.061] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0097.062] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.077] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.081] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.087] CloseHandle (hObject=0x1ac) returned 1 [0097.087] CloseHandle (hObject=0x1a8) returned 1 [0097.088] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.088] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.089] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0097.089] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.089] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.089] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 1 [0097.090] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0097.090] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.090] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0097.090] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.090] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0097.090] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.090] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.090] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.090] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.091] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0097.091] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.091] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.099] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.140] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd7, lpOverlapped=0x0) returned 1 [0097.141] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0097.142] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.157] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.160] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.167] CloseHandle (hObject=0x1a8) returned 1 [0097.167] CloseHandle (hObject=0x1ac) returned 1 [0097.168] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.168] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.168] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0097.168] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.168] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0097.169] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 1 [0097.169] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0097.169] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.169] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0097.170] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.170] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0097.170] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.170] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.170] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.171] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.171] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf5 [0097.171] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.171] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.179] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.219] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf5, lpOverlapped=0x0) returned 1 [0097.221] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0097.222] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.236] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.240] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.246] CloseHandle (hObject=0x1ac) returned 1 [0097.247] CloseHandle (hObject=0x1a8) returned 1 [0097.247] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.248] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.248] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0097.248] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.248] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0097.248] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 1 [0097.249] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0097.249] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.249] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.249] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.249] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0097.249] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.249] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.250] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.250] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.250] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0097.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.250] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.258] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.299] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0097.300] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0097.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.315] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.319] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.325] CloseHandle (hObject=0x1a8) returned 1 [0097.325] CloseHandle (hObject=0x1ac) returned 1 [0097.326] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.327] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.327] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0097.327] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.327] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0097.327] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 1 [0097.328] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0097.328] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.328] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.328] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.328] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0097.328] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.328] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.329] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.330] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.330] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0097.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.330] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.337] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.379] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xeb, lpOverlapped=0x0) returned 1 [0097.380] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0097.381] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.396] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.400] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.406] CloseHandle (hObject=0x1ac) returned 1 [0097.406] CloseHandle (hObject=0x1a8) returned 1 [0097.407] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0097.408] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.408] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.408] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 1 [0097.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0097.409] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.409] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0097.409] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.409] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0097.409] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.409] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.410] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5 [0097.410] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.410] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.417] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.492] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe5, lpOverlapped=0x0) returned 1 [0097.493] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0097.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.519] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.522] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.528] CloseHandle (hObject=0x1a8) returned 1 [0097.529] CloseHandle (hObject=0x1ac) returned 1 [0097.529] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.530] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.530] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0097.530] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.530] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0097.530] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 1 [0097.531] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0097.531] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.531] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.531] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.531] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0097.532] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.532] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.532] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.534] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.534] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0 [0097.534] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.534] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.541] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.583] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0097.583] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0097.584] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.599] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.602] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.609] CloseHandle (hObject=0x1ac) returned 1 [0097.609] CloseHandle (hObject=0x1a8) returned 1 [0097.610] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.610] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.610] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0097.617] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.617] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0097.617] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 1 [0097.618] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0097.618] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.618] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.618] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.618] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0097.618] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.618] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.619] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.619] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.619] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0097.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.620] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.626] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.669] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0097.670] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0097.671] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.686] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.690] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.696] CloseHandle (hObject=0x1a8) returned 1 [0097.696] CloseHandle (hObject=0x1ac) returned 1 [0097.697] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.698] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.698] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0097.698] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.698] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0097.698] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 1 [0097.699] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0097.699] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.699] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0097.699] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.699] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0097.699] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.699] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.700] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.748] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.748] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf [0097.748] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.749] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.755] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.796] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbf, lpOverlapped=0x0) returned 1 [0097.797] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0097.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.813] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.817] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.826] CloseHandle (hObject=0x1ac) returned 1 [0097.826] CloseHandle (hObject=0x1a8) returned 1 [0097.827] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.828] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.828] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0097.828] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.828] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0097.828] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 1 [0097.830] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0097.830] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.830] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0097.831] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.831] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0097.831] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.831] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.831] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.831] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.832] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1 [0097.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.832] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.842] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0097.945] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd1, lpOverlapped=0x0) returned 1 [0097.945] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0097.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0097.962] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0097.965] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.972] CloseHandle (hObject=0x1a8) returned 1 [0097.972] CloseHandle (hObject=0x1ac) returned 1 [0097.973] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0097.974] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0097.974] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0097.974] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0097.974] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0097.974] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 1 [0097.975] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0097.975] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0097.975] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0097.975] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0097.975] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0097.976] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.976] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0097.976] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0097.977] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0097.977] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0097.977] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0097.978] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0097.985] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.028] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0098.029] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0098.029] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.044] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.048] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.056] CloseHandle (hObject=0x1ac) returned 1 [0098.056] CloseHandle (hObject=0x1a8) returned 1 [0098.057] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.057] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.057] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0098.057] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.057] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0098.058] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0098.058] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0098.058] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.058] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0098.059] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.059] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0098.059] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.059] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.059] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.059] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.059] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0098.059] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.060] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.067] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.108] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe6, lpOverlapped=0x0) returned 1 [0098.108] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0098.109] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.124] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.128] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.135] CloseHandle (hObject=0x1a8) returned 1 [0098.135] CloseHandle (hObject=0x1ac) returned 1 [0098.136] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.136] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.136] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0098.137] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.137] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0098.137] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0098.138] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0098.138] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.138] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0098.140] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.140] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0098.140] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.140] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.141] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.142] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.142] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0098.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.142] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.149] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.191] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe2, lpOverlapped=0x0) returned 1 [0098.191] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0098.192] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.207] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.211] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.217] CloseHandle (hObject=0x1ac) returned 1 [0098.218] CloseHandle (hObject=0x1a8) returned 1 [0098.218] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.219] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.219] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0098.219] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.219] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0098.219] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 1 [0098.220] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0098.220] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.220] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0098.220] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.221] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0098.221] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.221] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.221] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.221] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.221] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0098.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.222] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.228] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.270] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfe, lpOverlapped=0x0) returned 1 [0098.271] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0098.272] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.286] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.290] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.296] CloseHandle (hObject=0x1a8) returned 1 [0098.297] CloseHandle (hObject=0x1ac) returned 1 [0098.297] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.298] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.298] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0098.298] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.298] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0098.298] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 1 [0098.299] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0098.299] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.299] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0098.299] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.299] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0098.300] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.300] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.300] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.307] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.308] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdb [0098.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.309] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.317] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.366] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdb, lpOverlapped=0x0) returned 1 [0098.367] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0098.368] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.383] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.386] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.395] CloseHandle (hObject=0x1ac) returned 1 [0098.395] CloseHandle (hObject=0x1a8) returned 1 [0098.396] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.396] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.396] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0098.397] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.397] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0098.397] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 1 [0098.398] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0098.398] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.398] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0098.398] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.398] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0098.398] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.398] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.398] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.398] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.399] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0098.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.399] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.406] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.450] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0098.450] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0098.451] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.466] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.470] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.476] CloseHandle (hObject=0x1a8) returned 1 [0098.477] CloseHandle (hObject=0x1ac) returned 1 [0098.477] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.478] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0098.478] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.478] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0098.478] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 1 [0098.479] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0098.479] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.479] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0098.479] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.479] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0098.480] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.480] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.482] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.482] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0098.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.483] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.490] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.531] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xec, lpOverlapped=0x0) returned 1 [0098.532] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0098.533] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.547] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.551] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.558] CloseHandle (hObject=0x1ac) returned 1 [0098.558] CloseHandle (hObject=0x1a8) returned 1 [0098.559] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.559] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.560] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0098.560] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.560] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0098.560] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 1 [0098.561] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0098.561] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.561] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0098.561] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0098.561] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.561] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.562] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0098.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.562] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.569] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.610] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd8, lpOverlapped=0x0) returned 1 [0098.618] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0098.619] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.636] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.640] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.647] CloseHandle (hObject=0x1a8) returned 1 [0098.647] CloseHandle (hObject=0x1ac) returned 1 [0098.648] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.648] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.649] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0098.649] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.649] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0098.649] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 1 [0098.650] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0098.650] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.650] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0098.650] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.650] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0098.650] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.650] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.650] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.652] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.652] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a [0098.652] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.652] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.660] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.701] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10a, lpOverlapped=0x0) returned 1 [0098.703] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0098.704] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.719] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.723] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.730] CloseHandle (hObject=0x1ac) returned 1 [0098.730] CloseHandle (hObject=0x1a8) returned 1 [0098.731] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.731] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.731] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0098.731] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.731] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0098.731] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 1 [0098.732] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0098.732] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.732] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0098.732] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.732] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0098.733] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.733] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.733] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.733] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.733] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe1 [0098.733] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.734] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.741] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.782] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe1, lpOverlapped=0x0) returned 1 [0098.783] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0098.784] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.799] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.802] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.808] CloseHandle (hObject=0x1a8) returned 1 [0098.809] CloseHandle (hObject=0x1ac) returned 1 [0098.809] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.810] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.810] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0098.810] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.810] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0098.810] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 1 [0098.811] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0098.811] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.811] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0098.811] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.811] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0098.811] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.812] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.812] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.814] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.815] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0098.815] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.815] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0098.821] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0098.960] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfe, lpOverlapped=0x0) returned 1 [0098.961] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0098.961] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0098.978] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0098.982] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.991] CloseHandle (hObject=0x1ac) returned 1 [0098.991] CloseHandle (hObject=0x1a8) returned 1 [0098.992] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0098.993] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0098.993] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0098.993] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0098.993] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0098.993] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 1 [0098.994] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0098.994] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0098.995] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0098.995] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0098.995] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0098.995] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.995] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0098.995] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0098.996] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0098.996] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0098.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0098.997] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.004] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.046] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe3, lpOverlapped=0x0) returned 1 [0099.048] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0099.049] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.072] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.076] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.083] CloseHandle (hObject=0x1a8) returned 1 [0099.083] CloseHandle (hObject=0x1ac) returned 1 [0099.084] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.084] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.084] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0099.084] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0099.085] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0099.085] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 1 [0099.085] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0099.086] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0099.086] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0099.086] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0099.086] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0099.086] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0099.086] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0099.086] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0099.086] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0099.087] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0099.087] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.087] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.094] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.137] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd4, lpOverlapped=0x0) returned 1 [0099.137] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0099.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.153] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.156] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.163] CloseHandle (hObject=0x1ac) returned 1 [0099.164] CloseHandle (hObject=0x1a8) returned 1 [0099.164] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.165] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.165] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0099.165] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0099.165] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0099.165] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0099.166] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0099.166] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0099.166] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0099.166] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0099.166] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0099.167] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0099.167] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0099.167] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0099.167] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0099.167] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0099.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.168] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.175] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.216] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd4, lpOverlapped=0x0) returned 1 [0099.217] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0099.217] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.232] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.236] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.243] CloseHandle (hObject=0x1a8) returned 1 [0099.243] CloseHandle (hObject=0x1ac) returned 1 [0099.244] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.245] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.245] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0099.245] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0099.245] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0099.245] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0099.246] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0099.246] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0099.246] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0099.246] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0099.246] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0099.246] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0099.246] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534cc0 [0099.246] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0099.246] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0099.247] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0099.247] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0099.277] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160 [0099.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.277] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.284] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.328] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x160, lpOverlapped=0x0) returned 1 [0099.328] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x170, lpOverlapped=0x0) returned 1 [0099.329] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.344] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.348] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.354] CloseHandle (hObject=0x1a4) returned 1 [0099.355] CloseHandle (hObject=0x1ac) returned 1 [0099.356] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.356] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.356] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535080 [0099.356] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0099.356] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0099.357] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 1 [0099.358] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0099.358] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0099.358] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0099.359] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0099.360] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b56 [0099.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.360] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.367] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.412] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2b56, lpOverlapped=0x0) returned 1 [0099.424] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2b60, lpOverlapped=0x0) returned 1 [0099.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.441] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.444] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.451] CloseHandle (hObject=0x1ac) returned 1 [0099.451] CloseHandle (hObject=0x1a4) returned 1 [0099.453] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.453] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.453] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534d00 [0099.453] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0099.453] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0099.454] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 1 [0099.455] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0099.455] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0099.455] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0099.455] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0099.455] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0099.455] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0099.455] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0099.455] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0099.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534cc0 [0099.456] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0099.456] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0099.456] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x534d00 [0099.500] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0099.500] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0099.501] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0099.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0099.502] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1378 [0099.502] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.503] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.509] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.551] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x1378, lpOverlapped=0x0) returned 1 [0099.617] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x1380, lpOverlapped=0x0) returned 1 [0099.618] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.633] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.637] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.643] CloseHandle (hObject=0x1b0) returned 1 [0099.643] CloseHandle (hObject=0x1a4) returned 1 [0099.644] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.645] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.645] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0099.645] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0099.645] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0099.645] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0099.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0xffffffff [0099.646] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0099.646] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0099.647] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0099.647] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1103 [0099.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.648] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.654] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.700] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x1103, lpOverlapped=0x0) returned 1 [0099.774] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x1110, lpOverlapped=0x0) returned 1 [0099.775] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.790] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.794] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.814] CloseHandle (hObject=0x1a4) returned 1 [0099.814] CloseHandle (hObject=0x1b0) returned 1 [0099.815] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.816] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.816] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535080 [0099.816] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0099.816] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0099.816] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1 [0099.817] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 0xffffffff [0099.817] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0099.817] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0099.817] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0099.818] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x356 [0099.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.818] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0099.825] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0099.867] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x356, lpOverlapped=0x0) returned 1 [0099.948] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x360, lpOverlapped=0x0) returned 1 [0099.949] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0099.970] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0099.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.982] CloseHandle (hObject=0x1b0) returned 1 [0099.982] CloseHandle (hObject=0x1a4) returned 1 [0099.983] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0099.984] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0099.984] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535240 [0099.984] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0099.984] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0099.985] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 1 [0099.986] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 0xffffffff [0099.988] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0099.988] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0099.996] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0099.997] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b6c [0099.997] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0099.997] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.004] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.087] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5b6c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5b6c, lpOverlapped=0x0) returned 1 [0100.104] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x5b70, lpOverlapped=0x0) returned 1 [0100.104] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.119] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.123] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.131] CloseHandle (hObject=0x1a4) returned 1 [0100.131] CloseHandle (hObject=0x1b0) returned 1 [0100.132] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.133] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.133] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0100.133] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0100.133] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0100.133] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1 [0100.134] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 0xffffffff [0100.134] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0100.135] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0100.135] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0100.135] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b1 [0100.135] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.136] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.142] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.185] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5b1, lpOverlapped=0x0) returned 1 [0100.192] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x5c0, lpOverlapped=0x0) returned 1 [0100.193] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.209] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.221] CloseHandle (hObject=0x1b0) returned 1 [0100.221] CloseHandle (hObject=0x1a4) returned 1 [0100.222] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.223] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.223] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534e40 [0100.223] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0100.223] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0100.223] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 1 [0100.224] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 0xffffffff [0100.224] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0100.225] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0100.225] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0100.226] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0100.226] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.226] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.233] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.287] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xe0, lpOverlapped=0x0) returned 1 [0100.287] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xf0, lpOverlapped=0x0) returned 1 [0100.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.306] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.314] CloseHandle (hObject=0x1a4) returned 1 [0100.314] CloseHandle (hObject=0x1b0) returned 1 [0100.315] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5351c0 [0100.315] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0100.315] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0100.315] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1 [0100.316] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 0xffffffff [0100.316] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0100.316] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534e40 [0100.320] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.320] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.320] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0100.320] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.320] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.321] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.321] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.321] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84 [0100.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.322] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.329] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.372] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x84, lpOverlapped=0x0) returned 1 [0100.373] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x90, lpOverlapped=0x0) returned 1 [0100.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.389] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.400] CloseHandle (hObject=0x1ac) returned 1 [0100.400] CloseHandle (hObject=0x1a8) returned 1 [0100.401] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.403] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.403] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0100.404] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.404] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0100.404] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 1 [0100.405] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 0xffffffff [0100.405] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0100.405] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0100.405] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.405] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0100.406] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.406] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.406] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.408] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.408] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0100.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.409] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.417] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.463] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x103, lpOverlapped=0x0) returned 1 [0100.464] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0100.465] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.480] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.483] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.490] CloseHandle (hObject=0x1a8) returned 1 [0100.490] CloseHandle (hObject=0x1ac) returned 1 [0100.491] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.492] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.492] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0100.492] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.492] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0100.492] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 1 [0100.493] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 0xffffffff [0100.493] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0100.493] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0100.493] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.493] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0100.493] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.493] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.494] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.494] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.494] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0100.494] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.494] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.502] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.543] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xed, lpOverlapped=0x0) returned 1 [0100.544] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0100.545] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.559] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.569] CloseHandle (hObject=0x1ac) returned 1 [0100.570] CloseHandle (hObject=0x1a8) returned 1 [0100.571] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.571] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.571] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0100.571] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.571] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0100.571] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 1 [0100.572] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0100.572] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0100.572] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0100.573] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.573] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0100.575] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.575] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.575] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.575] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.576] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7 [0100.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.576] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.583] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.631] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xa7, lpOverlapped=0x0) returned 1 [0100.633] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0100.633] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.649] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.653] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.659] CloseHandle (hObject=0x1a8) returned 1 [0100.659] CloseHandle (hObject=0x1ac) returned 1 [0100.660] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.661] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0100.661] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.661] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0100.661] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 1 [0100.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 0xffffffff [0100.662] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0100.662] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0100.662] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0100.662] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.662] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.663] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0100.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.663] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.672] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.716] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x114, lpOverlapped=0x0) returned 1 [0100.717] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0100.718] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.733] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.737] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.743] CloseHandle (hObject=0x1ac) returned 1 [0100.744] CloseHandle (hObject=0x1a8) returned 1 [0100.745] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.746] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.746] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0100.746] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.746] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0100.746] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 1 [0100.747] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0100.747] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0100.747] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0100.747] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.747] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0100.748] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.748] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.749] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.749] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.749] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14b [0100.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.750] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.757] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.803] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x14b, lpOverlapped=0x0) returned 1 [0100.828] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0100.829] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.844] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.848] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.855] CloseHandle (hObject=0x1a8) returned 1 [0100.855] CloseHandle (hObject=0x1ac) returned 1 [0100.856] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.857] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.857] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0100.857] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.857] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0100.857] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 1 [0100.858] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 0xffffffff [0100.858] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0100.858] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0100.858] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0100.858] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0100.858] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.859] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0100.859] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0100.859] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0100.859] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0100.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0100.860] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0100.866] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0100.970] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcf, lpOverlapped=0x0) returned 1 [0100.972] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0100.973] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0100.987] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0100.991] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.997] CloseHandle (hObject=0x1ac) returned 1 [0100.998] CloseHandle (hObject=0x1a8) returned 1 [0100.998] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0100.999] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0100.999] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0100.999] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0100.999] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0100.999] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 1 [0101.000] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0101.000] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.000] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0101.000] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.000] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0101.001] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.001] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.001] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.002] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.002] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0101.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.002] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.009] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.050] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xad, lpOverlapped=0x0) returned 1 [0101.052] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0101.053] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.068] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.071] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.078] CloseHandle (hObject=0x1a8) returned 1 [0101.078] CloseHandle (hObject=0x1ac) returned 1 [0101.079] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.079] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.079] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0101.079] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.080] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0101.080] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 1 [0101.080] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0101.080] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.081] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0101.081] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.081] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.081] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.081] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.081] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.081] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.088] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0101.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.089] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.133] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.177] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xac, lpOverlapped=0x0) returned 1 [0101.178] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0101.178] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.194] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.199] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.205] CloseHandle (hObject=0x1ac) returned 1 [0101.206] CloseHandle (hObject=0x1a8) returned 1 [0101.207] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.207] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.207] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0101.207] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.207] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0101.207] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 1 [0101.208] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 0xffffffff [0101.208] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.208] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.209] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.210] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.210] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.210] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.210] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.212] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1 [0101.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.212] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.219] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.261] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc1, lpOverlapped=0x0) returned 1 [0101.262] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0101.262] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.278] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.281] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.288] CloseHandle (hObject=0x1a8) returned 1 [0101.288] CloseHandle (hObject=0x1ac) returned 1 [0101.289] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.289] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.289] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0101.289] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.289] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0101.289] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 1 [0101.290] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 0xffffffff [0101.290] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.290] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.291] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.291] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.291] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.291] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.291] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.291] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.292] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12a [0101.292] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.292] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.299] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.340] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x12a, lpOverlapped=0x0) returned 1 [0101.355] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0101.356] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.372] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.376] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.382] CloseHandle (hObject=0x1ac) returned 1 [0101.382] CloseHandle (hObject=0x1a8) returned 1 [0101.383] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.384] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.384] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0101.384] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.384] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0101.384] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 1 [0101.385] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 0xffffffff [0101.385] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.385] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.385] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.385] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.387] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.387] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.387] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.387] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.387] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0101.387] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.388] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.394] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.437] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb2, lpOverlapped=0x0) returned 1 [0101.437] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0101.438] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.453] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.456] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.463] CloseHandle (hObject=0x1a8) returned 1 [0101.463] CloseHandle (hObject=0x1ac) returned 1 [0101.465] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.465] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.465] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0101.465] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.465] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0101.466] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 1 [0101.466] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0101.466] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.466] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.467] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.467] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0101.467] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.467] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.468] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0101.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.468] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.475] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.516] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x109, lpOverlapped=0x0) returned 1 [0101.517] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0101.517] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.533] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.537] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.544] CloseHandle (hObject=0x1ac) returned 1 [0101.544] CloseHandle (hObject=0x1a8) returned 1 [0101.545] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.545] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.545] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0101.545] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.545] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.546] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 1 [0101.546] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 0xffffffff [0101.546] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.546] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0101.547] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.547] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0101.548] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.548] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.548] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.548] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.549] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0101.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.549] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.555] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.598] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcc, lpOverlapped=0x0) returned 1 [0101.599] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0101.599] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.614] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.618] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.629] CloseHandle (hObject=0x1a8) returned 1 [0101.630] CloseHandle (hObject=0x1ac) returned 1 [0101.631] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.631] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.631] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0101.631] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.631] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0101.631] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 1 [0101.632] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 0xffffffff [0101.632] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.632] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0101.632] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.632] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.633] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.633] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.633] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.633] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.634] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0101.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.634] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.642] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.682] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe3, lpOverlapped=0x0) returned 1 [0101.684] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0101.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.700] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.704] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.711] CloseHandle (hObject=0x1ac) returned 1 [0101.711] CloseHandle (hObject=0x1a8) returned 1 [0101.712] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.712] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.712] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0101.713] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.713] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0101.713] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 1 [0101.713] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0101.714] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.714] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.714] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.714] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.715] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.715] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.715] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.715] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.716] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0101.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.716] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.723] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.765] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd4, lpOverlapped=0x0) returned 1 [0101.766] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0101.767] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.781] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.785] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.791] CloseHandle (hObject=0x1a8) returned 1 [0101.792] CloseHandle (hObject=0x1ac) returned 1 [0101.793] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.793] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.793] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0101.793] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.793] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0101.793] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 1 [0101.794] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 0xffffffff [0101.794] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.794] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.795] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.795] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.795] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.795] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.795] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.795] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.795] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98 [0101.795] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.796] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.802] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0101.844] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x98, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x98, lpOverlapped=0x0) returned 1 [0101.848] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xa0, lpOverlapped=0x0) returned 1 [0101.849] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0101.863] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0101.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.959] CloseHandle (hObject=0x1ac) returned 1 [0101.959] CloseHandle (hObject=0x1a8) returned 1 [0101.960] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0101.960] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0101.960] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0101.961] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0101.961] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0101.961] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 1 [0101.962] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 0xffffffff [0101.962] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0101.962] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0101.962] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0101.962] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0101.963] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.963] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0101.963] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0101.963] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0101.964] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0101.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0101.964] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0101.971] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.014] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xff, lpOverlapped=0x0) returned 1 [0102.015] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0102.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.031] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.035] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.042] CloseHandle (hObject=0x1a8) returned 1 [0102.042] CloseHandle (hObject=0x1ac) returned 1 [0102.043] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.044] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.044] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0102.044] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.044] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0102.044] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 1 [0102.045] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 0xffffffff [0102.045] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.045] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0102.045] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.045] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0102.046] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.046] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.046] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.046] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.046] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0102.046] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.047] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.053] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.098] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb7, lpOverlapped=0x0) returned 1 [0102.099] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0102.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.115] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.118] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.125] CloseHandle (hObject=0x1ac) returned 1 [0102.125] CloseHandle (hObject=0x1a8) returned 1 [0102.126] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.127] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.127] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0102.127] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.127] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0102.127] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 1 [0102.128] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0102.128] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.128] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0102.128] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0102.129] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.129] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.129] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.129] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.130] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7 [0102.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.130] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.139] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.180] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc7, lpOverlapped=0x0) returned 1 [0102.183] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0102.184] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.198] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.208] CloseHandle (hObject=0x1a8) returned 1 [0102.209] CloseHandle (hObject=0x1ac) returned 1 [0102.209] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.210] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.210] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0102.210] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.210] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0102.210] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 1 [0102.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0102.211] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.211] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0102.211] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.211] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0102.211] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.211] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.212] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.212] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.212] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0102.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.212] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.222] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.263] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbb, lpOverlapped=0x0) returned 1 [0102.264] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0102.265] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.280] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.283] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.290] CloseHandle (hObject=0x1ac) returned 1 [0102.290] CloseHandle (hObject=0x1a8) returned 1 [0102.291] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.291] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.291] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0102.291] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.291] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0102.291] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 1 [0102.293] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0102.293] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.293] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0102.293] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.293] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0102.298] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.298] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.298] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.298] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.299] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0102.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.299] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.306] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.347] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0102.348] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0102.349] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.364] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.367] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.374] CloseHandle (hObject=0x1a8) returned 1 [0102.374] CloseHandle (hObject=0x1ac) returned 1 [0102.375] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.376] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.376] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0102.376] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.376] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0102.376] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 1 [0102.377] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 0xffffffff [0102.377] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.377] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0102.377] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.378] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0102.378] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.378] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.378] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.378] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.378] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0102.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.379] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.385] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.428] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xac, lpOverlapped=0x0) returned 1 [0102.429] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0102.430] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.444] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.448] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.455] CloseHandle (hObject=0x1ac) returned 1 [0102.455] CloseHandle (hObject=0x1a8) returned 1 [0102.456] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.456] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.456] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0102.457] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.457] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0102.457] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 1 [0102.457] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 0xffffffff [0102.458] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.458] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0102.458] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.458] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0102.460] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.460] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.460] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.460] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.460] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0102.461] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.461] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.469] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.513] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x11e, lpOverlapped=0x0) returned 1 [0102.514] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0102.515] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.529] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.533] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.539] CloseHandle (hObject=0x1a8) returned 1 [0102.540] CloseHandle (hObject=0x1ac) returned 1 [0102.540] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.541] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.541] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0102.541] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.541] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0102.541] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 1 [0102.542] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 0xffffffff [0102.543] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.543] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0102.543] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.543] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0102.543] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.543] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.543] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.545] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0102.545] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.546] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.552] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.595] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x13e, lpOverlapped=0x0) returned 1 [0102.595] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x140, lpOverlapped=0x0) returned 1 [0102.596] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.611] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.614] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.626] CloseHandle (hObject=0x1ac) returned 1 [0102.626] CloseHandle (hObject=0x1a8) returned 1 [0102.627] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.628] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.628] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0102.628] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.628] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0102.628] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 1 [0102.629] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0102.629] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.629] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0102.629] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.629] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0102.630] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.630] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.630] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.630] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.631] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0102.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.631] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.638] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.678] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc8, lpOverlapped=0x0) returned 1 [0102.679] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0102.680] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.696] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.700] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.706] CloseHandle (hObject=0x1a8) returned 1 [0102.706] CloseHandle (hObject=0x1ac) returned 1 [0102.707] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.707] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.707] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0102.708] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.708] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0102.708] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 1 [0102.709] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0102.709] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.709] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0102.709] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.709] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0102.709] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.709] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.709] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.709] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.710] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0102.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.710] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.717] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.758] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc6, lpOverlapped=0x0) returned 1 [0102.760] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0102.761] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.776] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.780] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.786] CloseHandle (hObject=0x1ac) returned 1 [0102.786] CloseHandle (hObject=0x1a8) returned 1 [0102.787] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.788] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.788] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0102.788] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.788] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0102.788] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 1 [0102.789] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0102.789] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.789] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0102.789] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.789] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0102.790] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.790] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.790] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.790] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.790] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x299 [0102.790] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.791] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.798] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0102.839] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x299, lpOverlapped=0x0) returned 1 [0102.850] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0102.947] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0102.962] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0102.966] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.972] CloseHandle (hObject=0x1a8) returned 1 [0102.972] CloseHandle (hObject=0x1ac) returned 1 [0102.973] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0102.974] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0102.974] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0102.974] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0102.974] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0102.974] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 1 [0102.975] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 0xffffffff [0102.975] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0102.975] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0102.975] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0102.976] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0102.977] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.977] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0102.977] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0102.978] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0102.978] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0102.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0102.978] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0102.986] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.026] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbb, lpOverlapped=0x0) returned 1 [0103.028] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0103.029] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.043] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.047] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.053] CloseHandle (hObject=0x1ac) returned 1 [0103.054] CloseHandle (hObject=0x1a8) returned 1 [0103.055] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.055] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.055] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0103.055] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.055] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0103.056] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 1 [0103.056] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 0xffffffff [0103.057] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.057] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0103.057] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.057] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0103.057] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.057] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.057] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.057] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.058] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0103.058] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.058] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.065] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.112] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb2, lpOverlapped=0x0) returned 1 [0103.114] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0103.114] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.130] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.141] CloseHandle (hObject=0x1a8) returned 1 [0103.141] CloseHandle (hObject=0x1ac) returned 1 [0103.143] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.144] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.144] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0103.144] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.144] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0103.145] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 1 [0103.146] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 0xffffffff [0103.146] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.146] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.146] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.146] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0103.147] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.147] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.147] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.147] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.148] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0103.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.148] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.155] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.206] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb6, lpOverlapped=0x0) returned 1 [0103.206] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0103.207] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.222] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.225] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.234] CloseHandle (hObject=0x1ac) returned 1 [0103.235] CloseHandle (hObject=0x1a8) returned 1 [0103.235] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.236] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.236] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0103.237] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.237] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0103.237] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 1 [0103.238] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 0xffffffff [0103.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.238] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.238] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.238] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0103.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.238] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.238] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.239] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.239] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0103.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.239] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.246] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.289] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x16a, lpOverlapped=0x0) returned 1 [0103.290] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x170, lpOverlapped=0x0) returned 1 [0103.291] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.307] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.311] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.317] CloseHandle (hObject=0x1a8) returned 1 [0103.318] CloseHandle (hObject=0x1ac) returned 1 [0103.319] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.319] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.319] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0103.320] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.320] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0103.320] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 1 [0103.321] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 0xffffffff [0103.321] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.321] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.321] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.321] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0103.322] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.322] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.322] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.323] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.323] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0103.323] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.324] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.330] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.421] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfb, lpOverlapped=0x0) returned 1 [0103.422] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0103.422] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.442] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.463] CloseHandle (hObject=0x1ac) returned 1 [0103.463] CloseHandle (hObject=0x1a8) returned 1 [0103.464] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.465] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.465] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0103.465] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.465] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0103.465] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 1 [0103.466] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0103.466] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.466] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.466] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.466] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0103.466] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.466] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.466] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.467] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x165 [0103.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.467] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.474] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.515] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x165, lpOverlapped=0x0) returned 1 [0103.516] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x170, lpOverlapped=0x0) returned 1 [0103.517] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.532] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.535] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.542] CloseHandle (hObject=0x1a8) returned 1 [0103.544] CloseHandle (hObject=0x1ac) returned 1 [0103.545] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.545] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.545] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0103.545] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.545] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.545] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 1 [0103.546] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 0xffffffff [0103.546] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.546] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0103.546] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.546] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0103.547] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.547] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.548] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.548] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.549] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f [0103.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.549] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.555] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.597] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x25f, lpOverlapped=0x0) returned 1 [0103.599] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x260, lpOverlapped=0x0) returned 1 [0103.599] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.616] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.619] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.631] CloseHandle (hObject=0x1ac) returned 1 [0103.631] CloseHandle (hObject=0x1a8) returned 1 [0103.632] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.633] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.633] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0103.633] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.633] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0103.633] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 1 [0103.634] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 0xffffffff [0103.634] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.634] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0103.634] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.634] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0103.634] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.635] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.635] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.635] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.635] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x147 [0103.635] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.635] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.644] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.693] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x147, lpOverlapped=0x0) returned 1 [0103.693] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0103.694] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.709] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.712] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.719] CloseHandle (hObject=0x1a8) returned 1 [0103.719] CloseHandle (hObject=0x1ac) returned 1 [0103.720] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.721] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.721] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0103.721] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.721] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.721] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 1 [0103.722] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 0xffffffff [0103.722] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.722] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0103.722] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.722] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0103.723] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.723] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.723] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.724] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.724] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0103.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.724] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.732] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.774] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd9, lpOverlapped=0x0) returned 1 [0103.775] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0103.784] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.799] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.803] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.814] CloseHandle (hObject=0x1ac) returned 1 [0103.814] CloseHandle (hObject=0x1a8) returned 1 [0103.815] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.816] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.816] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0103.816] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.816] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0103.816] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 1 [0103.817] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0103.817] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.817] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.817] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.817] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0103.817] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.817] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.818] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.818] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.818] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c2 [0103.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.818] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.825] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0103.867] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x1c2, lpOverlapped=0x0) returned 1 [0103.867] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x1d0, lpOverlapped=0x0) returned 1 [0103.868] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0103.939] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0103.943] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.951] CloseHandle (hObject=0x1a8) returned 1 [0103.952] CloseHandle (hObject=0x1ac) returned 1 [0103.953] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0103.953] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0103.953] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0103.953] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0103.953] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0103.953] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 1 [0103.954] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 0xffffffff [0103.954] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0103.954] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0103.954] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0103.955] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0103.956] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.956] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0103.956] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0103.957] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0103.957] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0103.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0103.957] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0103.964] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.006] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0104.007] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0104.007] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.023] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.026] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.034] CloseHandle (hObject=0x1ac) returned 1 [0104.034] CloseHandle (hObject=0x1a8) returned 1 [0104.035] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.035] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.035] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0104.036] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.036] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0104.036] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 1 [0104.037] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0104.037] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.037] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0104.037] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.037] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0104.037] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.037] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.037] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.039] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.039] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0104.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.039] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.047] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.088] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc6, lpOverlapped=0x0) returned 1 [0104.089] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0104.089] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.105] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.108] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.115] CloseHandle (hObject=0x1a8) returned 1 [0104.115] CloseHandle (hObject=0x1ac) returned 1 [0104.116] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.116] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.116] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0104.117] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.117] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0104.117] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 1 [0104.118] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0104.118] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.118] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0104.118] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.118] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0104.119] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.119] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.119] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.119] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.119] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x183 [0104.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.120] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.127] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.169] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x183, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x183, lpOverlapped=0x0) returned 1 [0104.331] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x190, lpOverlapped=0x0) returned 1 [0104.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.347] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.358] CloseHandle (hObject=0x1ac) returned 1 [0104.358] CloseHandle (hObject=0x1a8) returned 1 [0104.359] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.359] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.359] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0104.360] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.360] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0104.360] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 1 [0104.361] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 0xffffffff [0104.361] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.361] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0104.361] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.361] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0104.361] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.361] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.362] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.362] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.362] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c3 [0104.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.363] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.369] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.412] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x1c3, lpOverlapped=0x0) returned 1 [0104.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x1d0, lpOverlapped=0x0) returned 1 [0104.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.430] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.440] CloseHandle (hObject=0x1a8) returned 1 [0104.441] CloseHandle (hObject=0x1ac) returned 1 [0104.442] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.442] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.442] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0104.443] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.443] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0104.443] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 1 [0104.444] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 0xffffffff [0104.444] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.444] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0104.444] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.444] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0104.445] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.445] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.445] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.446] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.446] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0104.446] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.446] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.455] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.496] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x12c, lpOverlapped=0x0) returned 1 [0104.497] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0104.498] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.513] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.523] CloseHandle (hObject=0x1ac) returned 1 [0104.523] CloseHandle (hObject=0x1a8) returned 1 [0104.524] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.524] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.524] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0104.524] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.524] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0104.524] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 1 [0104.525] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 0xffffffff [0104.525] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.525] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0104.525] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.525] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0104.526] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.526] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.527] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0104.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.527] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.535] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.579] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcb, lpOverlapped=0x0) returned 1 [0104.579] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0104.580] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.595] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.599] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.606] CloseHandle (hObject=0x1a8) returned 1 [0104.606] CloseHandle (hObject=0x1ac) returned 1 [0104.607] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.608] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.608] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0104.608] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.608] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0104.608] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 1 [0104.609] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0104.609] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.609] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0104.609] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.609] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0104.610] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.610] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.611] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.611] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.611] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20b [0104.611] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.611] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.618] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.666] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x20b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x20b, lpOverlapped=0x0) returned 1 [0104.666] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x210, lpOverlapped=0x0) returned 1 [0104.667] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.682] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.686] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.693] CloseHandle (hObject=0x1ac) returned 1 [0104.693] CloseHandle (hObject=0x1a8) returned 1 [0104.694] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.695] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.695] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0104.695] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.695] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0104.695] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 1 [0104.696] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 0xffffffff [0104.696] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.696] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0104.696] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.696] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0104.697] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.697] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.697] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.697] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.697] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0104.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.698] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.705] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.749] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb1, lpOverlapped=0x0) returned 1 [0104.749] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0104.767] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.783] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.787] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.794] CloseHandle (hObject=0x1a8) returned 1 [0104.795] CloseHandle (hObject=0x1ac) returned 1 [0104.795] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.796] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.796] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0104.796] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.796] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0104.796] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 1 [0104.797] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0104.797] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.797] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0104.797] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.797] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0104.798] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.798] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.799] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.799] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.801] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96 [0104.801] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.802] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.808] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.851] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x96, lpOverlapped=0x0) returned 1 [0104.852] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xa0, lpOverlapped=0x0) returned 1 [0104.852] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0104.867] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0104.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.945] CloseHandle (hObject=0x1ac) returned 1 [0104.945] CloseHandle (hObject=0x1a8) returned 1 [0104.946] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0104.947] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0104.947] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0104.947] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0104.947] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0104.947] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 1 [0104.948] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 0xffffffff [0104.948] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0104.948] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0104.948] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0104.948] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0104.948] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.948] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0104.949] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0104.949] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0104.949] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0104.949] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0104.949] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0104.957] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0104.998] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb4, lpOverlapped=0x0) returned 1 [0104.999] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0105.000] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.014] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.024] CloseHandle (hObject=0x1a8) returned 1 [0105.024] CloseHandle (hObject=0x1ac) returned 1 [0105.025] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.026] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.026] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0105.026] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.026] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0105.026] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 1 [0105.027] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0105.027] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.027] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0105.027] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.027] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0105.029] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.029] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.029] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.029] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.030] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0105.030] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.030] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.037] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.078] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbb, lpOverlapped=0x0) returned 1 [0105.080] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0105.081] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.096] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.106] CloseHandle (hObject=0x1ac) returned 1 [0105.106] CloseHandle (hObject=0x1a8) returned 1 [0105.107] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.107] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.107] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0105.107] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.107] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0105.108] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 1 [0105.108] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0105.108] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.108] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0105.109] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.109] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0105.109] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.109] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.109] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.109] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.109] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0105.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.110] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.116] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.175] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc6, lpOverlapped=0x0) returned 1 [0105.182] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0105.183] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.204] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.214] CloseHandle (hObject=0x1a8) returned 1 [0105.215] CloseHandle (hObject=0x1ac) returned 1 [0105.216] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.216] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.216] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0105.217] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.217] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0105.218] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 1 [0105.218] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0105.219] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.219] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0105.219] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.219] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0105.221] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.221] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.221] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.221] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.221] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0105.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.222] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.228] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.271] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xaf, lpOverlapped=0x0) returned 1 [0105.272] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0105.272] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.289] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.299] CloseHandle (hObject=0x1ac) returned 1 [0105.299] CloseHandle (hObject=0x1a8) returned 1 [0105.300] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.301] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.301] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0105.301] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.301] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0105.301] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 1 [0105.302] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0105.302] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.302] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0105.302] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.302] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0105.302] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.302] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.302] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.303] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.303] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0105.303] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.303] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.310] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.351] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x119, lpOverlapped=0x0) returned 1 [0105.353] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0105.354] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.368] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.379] CloseHandle (hObject=0x1a8) returned 1 [0105.379] CloseHandle (hObject=0x1ac) returned 1 [0105.380] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.381] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.381] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0105.381] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.381] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0105.381] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 1 [0105.382] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0105.382] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.382] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0105.382] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.382] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0105.383] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.383] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.383] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.383] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.384] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0105.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.384] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.391] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.432] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x14e, lpOverlapped=0x0) returned 1 [0105.434] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0105.435] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.450] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.453] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.460] CloseHandle (hObject=0x1ac) returned 1 [0105.460] CloseHandle (hObject=0x1a8) returned 1 [0105.461] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.461] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.461] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0105.461] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.461] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0105.461] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 1 [0105.462] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 0xffffffff [0105.462] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.462] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0105.462] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.462] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0105.463] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.463] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.463] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.463] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.463] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5 [0105.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.464] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.471] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.512] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc5, lpOverlapped=0x0) returned 1 [0105.513] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0105.514] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.528] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.532] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.539] CloseHandle (hObject=0x1a8) returned 1 [0105.539] CloseHandle (hObject=0x1ac) returned 1 [0105.540] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.540] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.541] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0105.541] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.541] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0105.541] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 1 [0105.542] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0105.542] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.542] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0105.542] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.542] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0105.544] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.544] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.544] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.544] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.545] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe [0105.545] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.545] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.552] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.593] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbe, lpOverlapped=0x0) returned 1 [0105.594] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0105.595] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.610] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.613] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.620] CloseHandle (hObject=0x1ac) returned 1 [0105.620] CloseHandle (hObject=0x1a8) returned 1 [0105.621] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.627] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.627] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0105.627] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.627] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0105.627] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 1 [0105.628] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0105.628] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.628] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0105.628] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.628] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0105.629] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.629] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.629] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.629] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.629] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0105.629] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.630] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.636] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.677] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x104, lpOverlapped=0x0) returned 1 [0105.679] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0105.680] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.695] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.705] CloseHandle (hObject=0x1a8) returned 1 [0105.706] CloseHandle (hObject=0x1ac) returned 1 [0105.707] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.707] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.707] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0105.707] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.707] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0105.707] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 1 [0105.708] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0105.708] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.708] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0105.708] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.709] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0105.709] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.709] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.710] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.710] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.710] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0105.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.710] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.718] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.808] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0105.810] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0105.810] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0105.826] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0105.830] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.837] CloseHandle (hObject=0x1ac) returned 1 [0105.837] CloseHandle (hObject=0x1a8) returned 1 [0105.838] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0105.839] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0105.839] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0105.839] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0105.839] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0105.839] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 1 [0105.840] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0105.840] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0105.840] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0105.840] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0105.840] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0105.840] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.840] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0105.841] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0105.841] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0105.841] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0105.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0105.842] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0105.848] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0105.988] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc4, lpOverlapped=0x0) returned 1 [0105.990] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0105.990] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.005] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.009] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.015] CloseHandle (hObject=0x1a8) returned 1 [0106.015] CloseHandle (hObject=0x1ac) returned 1 [0106.016] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.016] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.016] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0106.016] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.016] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0106.017] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 1 [0106.017] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 0xffffffff [0106.017] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.017] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0106.017] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.017] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0106.019] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.019] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.019] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.019] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.020] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150 [0106.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.020] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.027] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.068] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x150, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0106.069] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x160, lpOverlapped=0x0) returned 1 [0106.070] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.085] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.089] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.096] CloseHandle (hObject=0x1ac) returned 1 [0106.096] CloseHandle (hObject=0x1a8) returned 1 [0106.096] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.097] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.097] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0106.097] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.097] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0106.097] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 1 [0106.098] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 0xffffffff [0106.098] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.098] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0106.098] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.098] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0106.098] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.098] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.098] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.099] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.099] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0106.099] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.099] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.106] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.148] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x115, lpOverlapped=0x0) returned 1 [0106.149] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0106.150] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.165] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.169] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.176] CloseHandle (hObject=0x1a8) returned 1 [0106.176] CloseHandle (hObject=0x1ac) returned 1 [0106.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.177] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0106.177] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.177] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0106.177] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 1 [0106.186] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 0xffffffff [0106.186] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.186] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0106.186] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.186] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0106.187] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.188] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.188] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.188] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.188] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0106.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.189] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.195] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.238] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x125, lpOverlapped=0x0) returned 1 [0106.238] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0106.239] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.254] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.258] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.264] CloseHandle (hObject=0x1ac) returned 1 [0106.264] CloseHandle (hObject=0x1a8) returned 1 [0106.264] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.265] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.265] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0106.265] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.265] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0106.265] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 1 [0106.266] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 0xffffffff [0106.266] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.266] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0106.266] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.266] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0106.266] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.266] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.267] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.267] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.267] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd [0106.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.267] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.274] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.316] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcd, lpOverlapped=0x0) returned 1 [0106.317] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0106.318] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.333] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.336] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.343] CloseHandle (hObject=0x1a8) returned 1 [0106.343] CloseHandle (hObject=0x1ac) returned 1 [0106.343] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.344] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.344] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0106.344] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.344] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0106.344] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 1 [0106.345] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0106.345] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.345] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0106.345] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.345] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0106.347] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.347] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.347] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.347] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.348] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0106.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.348] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.355] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.398] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x115, lpOverlapped=0x0) returned 1 [0106.400] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0106.400] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.417] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.421] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.427] CloseHandle (hObject=0x1ac) returned 1 [0106.428] CloseHandle (hObject=0x1a8) returned 1 [0106.428] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.428] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.428] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0106.428] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.429] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0106.429] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 1 [0106.429] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0106.430] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.430] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0106.430] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.430] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0106.430] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.430] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.430] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.430] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.431] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x177 [0106.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.431] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.438] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.481] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x177, lpOverlapped=0x0) returned 1 [0106.482] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x180, lpOverlapped=0x0) returned 1 [0106.483] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.498] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.502] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.508] CloseHandle (hObject=0x1a8) returned 1 [0106.509] CloseHandle (hObject=0x1ac) returned 1 [0106.509] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.509] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.509] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0106.510] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.510] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0106.510] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 1 [0106.510] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 0xffffffff [0106.510] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.510] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0106.511] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.511] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0106.512] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.512] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.512] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.512] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.513] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0106.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.513] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.520] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.676] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0106.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0106.679] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.695] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.698] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.705] CloseHandle (hObject=0x1ac) returned 1 [0106.705] CloseHandle (hObject=0x1a8) returned 1 [0106.705] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.706] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.706] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0106.706] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.706] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0106.706] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 1 [0106.707] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0106.707] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.707] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0106.707] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.707] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0106.707] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.707] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.708] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.708] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0106.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.708] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.715] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.756] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0106.757] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0106.758] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.773] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.777] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.783] CloseHandle (hObject=0x1a8) returned 1 [0106.783] CloseHandle (hObject=0x1ac) returned 1 [0106.783] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.784] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.784] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0106.784] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.784] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0106.784] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 1 [0106.785] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0106.785] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.785] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0106.785] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.785] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0106.786] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.786] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.786] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.786] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.787] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0106.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.787] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.794] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0106.836] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0106.837] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0106.838] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0106.853] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0106.856] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.863] CloseHandle (hObject=0x1ac) returned 1 [0106.863] CloseHandle (hObject=0x1a8) returned 1 [0106.863] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0106.864] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0106.864] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0106.864] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0106.864] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0106.864] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 1 [0106.865] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 0xffffffff [0106.865] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0106.865] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0106.865] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0106.865] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0106.865] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.865] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0106.865] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0106.865] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0106.866] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0106.866] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0106.866] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0106.957] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.001] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xaa, lpOverlapped=0x0) returned 1 [0107.001] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0107.002] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.018] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.021] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.028] CloseHandle (hObject=0x1a8) returned 1 [0107.028] CloseHandle (hObject=0x1ac) returned 1 [0107.028] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.029] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.029] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0107.029] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0107.029] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0107.029] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 1 [0107.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0107.030] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0107.030] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0107.030] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0107.030] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0107.030] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0107.030] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0107.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0107.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0107.031] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2 [0107.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.031] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.038] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.082] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc2, lpOverlapped=0x0) returned 1 [0107.084] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0107.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.100] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.104] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.111] CloseHandle (hObject=0x1ac) returned 1 [0107.111] CloseHandle (hObject=0x1a8) returned 1 [0107.111] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.112] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.112] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0107.112] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0107.112] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0107.112] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 1 [0107.113] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 0xffffffff [0107.113] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0107.113] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0107.113] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0107.113] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0107.113] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.113] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x5353c0 [0107.113] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0107.113] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0107.114] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.115] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0107.127] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0107.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.127] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.134] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.176] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xaf3, lpOverlapped=0x0) returned 1 [0107.196] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0xb00, lpOverlapped=0x0) returned 1 [0107.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.212] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.215] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.222] CloseHandle (hObject=0x1a4) returned 1 [0107.222] CloseHandle (hObject=0x1a8) returned 1 [0107.222] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.223] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.223] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0107.223] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0107.223] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0107.223] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 1 [0107.224] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0107.224] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0107.224] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0107.225] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.225] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4454 [0107.225] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.225] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.233] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.275] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4454, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x4454, lpOverlapped=0x0) returned 1 [0107.280] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x4460, lpOverlapped=0x0) returned 1 [0107.280] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.295] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.299] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.305] CloseHandle (hObject=0x1a8) returned 1 [0107.306] CloseHandle (hObject=0x1a4) returned 1 [0107.306] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.306] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.306] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534e40 [0107.306] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0107.306] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0107.307] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 1 [0107.307] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0107.307] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0107.308] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0107.308] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0107.308] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0107.308] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0107.308] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x535300 [0107.324] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.324] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.324] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0107.328] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.329] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1378 [0107.329] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.329] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.336] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.380] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x1378, lpOverlapped=0x0) returned 1 [0107.381] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x1380, lpOverlapped=0x0) returned 1 [0107.382] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.397] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.401] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.407] CloseHandle (hObject=0x1b0) returned 1 [0107.408] CloseHandle (hObject=0x1a4) returned 1 [0107.408] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5353c0 [0107.408] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0107.408] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0107.409] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png")) returned 1 [0107.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\128.png")) returned 0xffffffff [0107.409] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.414] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0107.415] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1103 [0107.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.415] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.423] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.464] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x1103, lpOverlapped=0x0) returned 1 [0107.466] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x1110, lpOverlapped=0x0) returned 1 [0107.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.482] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.485] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.492] CloseHandle (hObject=0x1a4) returned 1 [0107.492] CloseHandle (hObject=0x1b0) returned 1 [0107.492] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.493] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.493] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534e40 [0107.493] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0107.493] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0107.493] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js")) returned 1 [0107.494] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\contentscript_bin_prod.js")) returned 0xffffffff [0107.494] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.494] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0107.495] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.495] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x356 [0107.495] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.495] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.503] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.543] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x356, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x356, lpOverlapped=0x0) returned 1 [0107.557] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x360, lpOverlapped=0x0) returned 1 [0107.558] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.572] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.576] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.583] CloseHandle (hObject=0x1b0) returned 1 [0107.583] CloseHandle (hObject=0x1a4) returned 1 [0107.583] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.583] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.584] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0107.584] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0107.584] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0107.584] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json")) returned 1 [0107.585] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dasherSettingSchema.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\dashersettingschema.json")) returned 0xffffffff [0107.585] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.585] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.586] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0107.586] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b6c [0107.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.587] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.594] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.642] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5b6c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5b6c, lpOverlapped=0x0) returned 1 [0107.655] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x5b70, lpOverlapped=0x0) returned 1 [0107.656] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.671] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.674] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.681] CloseHandle (hObject=0x1a4) returned 1 [0107.681] CloseHandle (hObject=0x1b0) returned 1 [0107.681] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.682] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.682] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534d00 [0107.682] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0107.682] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0107.682] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js")) returned 1 [0107.683] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\eventpage_bin_prod.js")) returned 0xffffffff [0107.683] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.683] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0107.683] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.686] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b1 [0107.686] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.687] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.693] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.737] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5b1, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5b1, lpOverlapped=0x0) returned 1 [0107.738] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x5c0, lpOverlapped=0x0) returned 1 [0107.739] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.754] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.757] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.764] CloseHandle (hObject=0x1b0) returned 1 [0107.764] CloseHandle (hObject=0x1a4) returned 1 [0107.764] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.765] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.765] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5353c0 [0107.765] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0107.765] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0107.765] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json")) returned 1 [0107.766] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\manifest.json")) returned 0xffffffff [0107.766] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.766] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0107.766] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0107.767] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0 [0107.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.767] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.773] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0107.815] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xe0, lpOverlapped=0x0) returned 1 [0107.816] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xf0, lpOverlapped=0x0) returned 1 [0107.817] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0107.831] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0107.835] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.841] CloseHandle (hObject=0x1a4) returned 1 [0107.842] CloseHandle (hObject=0x1b0) returned 1 [0107.842] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0107.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0107.842] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534ec0 [0107.842] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0107.842] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0107.842] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js")) returned 1 [0107.843] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\page_embed_script.js")) returned 0xffffffff [0107.843] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0107.843] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535040 [0107.859] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0107.859] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0107.859] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0107.859] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0107.859] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0107.860] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0107.860] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0107.860] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x84 [0107.860] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0107.861] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0107.867] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.016] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x84, lpOverlapped=0x0) returned 1 [0108.016] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x90, lpOverlapped=0x0) returned 1 [0108.017] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.102] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.105] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.112] CloseHandle (hObject=0x1a8) returned 1 [0108.112] CloseHandle (hObject=0x1ac) returned 1 [0108.112] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.113] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.113] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0108.113] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.113] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0108.113] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json")) returned 1 [0108.114] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\af\\messages.json")) returned 0xffffffff [0108.114] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.114] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.114] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.114] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0108.115] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.115] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.115] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.115] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.116] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x103 [0108.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.116] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.149] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.191] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x103, lpOverlapped=0x0) returned 1 [0108.192] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0108.192] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.207] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.211] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.217] CloseHandle (hObject=0x1ac) returned 1 [0108.217] CloseHandle (hObject=0x1a8) returned 1 [0108.218] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.218] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.218] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0108.218] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.218] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0108.219] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json")) returned 1 [0108.219] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\am\\messages.json")) returned 0xffffffff [0108.219] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.219] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.219] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.220] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0108.220] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.220] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.220] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.220] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.221] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0108.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.221] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.227] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.272] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xed, lpOverlapped=0x0) returned 1 [0108.273] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0108.274] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.296] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.311] CloseHandle (hObject=0x1a8) returned 1 [0108.311] CloseHandle (hObject=0x1ac) returned 1 [0108.311] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.312] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.312] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0108.312] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.312] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.312] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json")) returned 1 [0108.313] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ar\\messages.json")) returned 0xffffffff [0108.313] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.313] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0108.313] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.313] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0108.315] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.315] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.315] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.315] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.316] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa7 [0108.316] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.316] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.323] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.367] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xa7, lpOverlapped=0x0) returned 1 [0108.367] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0108.368] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.384] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.394] CloseHandle (hObject=0x1ac) returned 1 [0108.394] CloseHandle (hObject=0x1a8) returned 1 [0108.395] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.395] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.395] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0108.395] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.396] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.396] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json")) returned 1 [0108.396] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\az\\messages.json")) returned 0xffffffff [0108.396] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.397] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0108.397] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.397] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0108.397] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.397] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.397] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.397] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.398] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x114 [0108.398] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.398] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.405] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.449] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x114, lpOverlapped=0x0) returned 1 [0108.453] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0108.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.469] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.473] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.482] CloseHandle (hObject=0x1a8) returned 1 [0108.482] CloseHandle (hObject=0x1ac) returned 1 [0108.482] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.483] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.483] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0108.483] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.483] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.483] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json")) returned 1 [0108.484] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bg\\messages.json")) returned 0xffffffff [0108.484] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.484] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0108.484] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.484] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0108.484] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.484] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.485] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.485] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.485] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14b [0108.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.486] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.493] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.536] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x14b, lpOverlapped=0x0) returned 1 [0108.537] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0108.538] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.554] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.558] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.566] CloseHandle (hObject=0x1ac) returned 1 [0108.566] CloseHandle (hObject=0x1a8) returned 1 [0108.568] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.569] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.569] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0108.569] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.569] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0108.569] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json")) returned 1 [0108.570] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\bn\\messages.json")) returned 0xffffffff [0108.570] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.570] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.572] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.572] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0108.572] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.572] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.572] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.573] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.573] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf [0108.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.574] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.580] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.629] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcf, lpOverlapped=0x0) returned 1 [0108.630] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0108.631] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.646] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.650] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.656] CloseHandle (hObject=0x1a8) returned 1 [0108.657] CloseHandle (hObject=0x1ac) returned 1 [0108.657] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.657] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.657] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0108.657] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.657] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.657] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json")) returned 1 [0108.658] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ca\\messages.json")) returned 0xffffffff [0108.658] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.658] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0108.658] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.658] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0108.659] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.659] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.659] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.659] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.659] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xad [0108.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.660] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.666] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.716] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xad, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xad, lpOverlapped=0x0) returned 1 [0108.717] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0108.717] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.732] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.735] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.743] CloseHandle (hObject=0x1ac) returned 1 [0108.743] CloseHandle (hObject=0x1a8) returned 1 [0108.743] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.743] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.744] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0108.744] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.744] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0108.744] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json")) returned 1 [0108.745] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\cs\\messages.json")) returned 0xffffffff [0108.745] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.745] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0108.745] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.745] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0108.745] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.745] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.745] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.745] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.746] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0108.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.746] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.753] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.796] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xac, lpOverlapped=0x0) returned 1 [0108.797] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0108.797] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.812] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.816] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.822] CloseHandle (hObject=0x1a8) returned 1 [0108.822] CloseHandle (hObject=0x1ac) returned 1 [0108.823] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.823] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.823] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0108.823] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.823] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0108.823] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json")) returned 1 [0108.824] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\da\\messages.json")) returned 0xffffffff [0108.824] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.824] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0108.824] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.824] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0108.824] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.825] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.825] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0108.825] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0108.825] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc1 [0108.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0108.826] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0108.837] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0108.882] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc1, lpOverlapped=0x0) returned 1 [0108.883] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0108.883] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0108.898] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0108.902] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.908] CloseHandle (hObject=0x1ac) returned 1 [0108.908] CloseHandle (hObject=0x1a8) returned 1 [0108.908] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0108.990] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0108.990] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0108.990] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0108.990] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0108.990] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json")) returned 1 [0108.991] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\de\\messages.json")) returned 0xffffffff [0108.991] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0108.991] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0108.991] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0108.991] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0108.999] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0108.999] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.000] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.000] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.000] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12a [0109.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.001] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.008] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.051] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x12a, lpOverlapped=0x0) returned 1 [0109.065] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0109.066] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.081] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.091] CloseHandle (hObject=0x1a8) returned 1 [0109.091] CloseHandle (hObject=0x1ac) returned 1 [0109.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0109.092] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.092] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0109.092] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json")) returned 1 [0109.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\el\\messages.json")) returned 0xffffffff [0109.093] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.093] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0109.093] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.093] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0109.093] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.093] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.093] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.093] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.094] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0109.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.094] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.102] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.143] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb2, lpOverlapped=0x0) returned 1 [0109.150] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0109.150] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.165] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.169] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.175] CloseHandle (hObject=0x1ac) returned 1 [0109.175] CloseHandle (hObject=0x1a8) returned 1 [0109.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.176] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.176] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0109.176] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.176] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0109.176] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json")) returned 1 [0109.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0109.177] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.177] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0109.177] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.178] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0109.184] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.184] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.185] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.185] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.185] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0109.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.186] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.193] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.233] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x109, lpOverlapped=0x0) returned 1 [0109.234] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0109.235] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.250] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.254] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.260] CloseHandle (hObject=0x1a8) returned 1 [0109.260] CloseHandle (hObject=0x1ac) returned 1 [0109.260] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.261] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.261] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0109.261] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.261] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0109.261] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json")) returned 1 [0109.262] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\en_us\\messages.json")) returned 0xffffffff [0109.262] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.262] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0109.262] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.262] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0109.262] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.262] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.262] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.263] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.263] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0109.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.263] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.271] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.312] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcc, lpOverlapped=0x0) returned 1 [0109.313] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0109.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.329] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.333] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.340] CloseHandle (hObject=0x1ac) returned 1 [0109.340] CloseHandle (hObject=0x1a8) returned 1 [0109.340] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.340] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.340] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0109.341] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.341] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0109.341] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json")) returned 1 [0109.341] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es\\messages.json")) returned 0xffffffff [0109.341] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.341] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0109.342] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.342] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0109.345] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.345] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.346] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.346] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.346] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3 [0109.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.347] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.355] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.412] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe3, lpOverlapped=0x0) returned 1 [0109.413] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0109.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.429] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.439] CloseHandle (hObject=0x1a8) returned 1 [0109.439] CloseHandle (hObject=0x1ac) returned 1 [0109.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.440] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0109.440] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.440] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0109.440] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json")) returned 1 [0109.441] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\es_419\\messages.json")) returned 0xffffffff [0109.441] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.441] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0109.442] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.442] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0109.442] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.442] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.442] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.447] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.448] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4 [0109.448] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.448] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.455] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.501] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd4, lpOverlapped=0x0) returned 1 [0109.502] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0109.504] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.524] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.528] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.537] CloseHandle (hObject=0x1ac) returned 1 [0109.537] CloseHandle (hObject=0x1a8) returned 1 [0109.537] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.537] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.537] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0109.538] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.538] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0109.538] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json")) returned 1 [0109.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\et\\messages.json")) returned 0xffffffff [0109.538] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.538] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0109.539] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.539] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0109.540] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.540] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.540] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.540] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.541] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98 [0109.541] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.541] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.548] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.591] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x98, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x98, lpOverlapped=0x0) returned 1 [0109.592] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xa0, lpOverlapped=0x0) returned 1 [0109.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.608] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.619] CloseHandle (hObject=0x1a8) returned 1 [0109.619] CloseHandle (hObject=0x1ac) returned 1 [0109.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0109.620] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.620] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0109.620] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json")) returned 1 [0109.621] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\eu\\messages.json")) returned 0xffffffff [0109.621] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.621] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0109.622] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.622] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0109.622] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.622] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.622] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.622] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.623] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0109.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.624] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.643] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.700] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xff, lpOverlapped=0x0) returned 1 [0109.701] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0109.702] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.719] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.723] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.730] CloseHandle (hObject=0x1ac) returned 1 [0109.730] CloseHandle (hObject=0x1a8) returned 1 [0109.731] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.731] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.731] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0109.731] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.731] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0109.731] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json")) returned 1 [0109.732] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fa\\messages.json")) returned 0xffffffff [0109.732] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.732] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0109.732] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.732] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0109.734] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.734] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.734] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.735] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.735] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb7 [0109.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.735] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.743] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.790] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb7, lpOverlapped=0x0) returned 1 [0109.790] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0109.791] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.806] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.810] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.818] CloseHandle (hObject=0x1a8) returned 1 [0109.818] CloseHandle (hObject=0x1ac) returned 1 [0109.818] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.819] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.819] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0109.819] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.819] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0109.819] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json")) returned 1 [0109.820] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fi\\messages.json")) returned 0xffffffff [0109.820] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.820] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0109.820] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.820] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0109.820] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.820] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.821] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.821] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.821] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc7 [0109.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.821] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.828] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.876] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc7, lpOverlapped=0x0) returned 1 [0109.877] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0109.877] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0109.892] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0109.896] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.903] CloseHandle (hObject=0x1ac) returned 1 [0109.903] CloseHandle (hObject=0x1a8) returned 1 [0109.904] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0109.904] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0109.904] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0109.904] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0109.904] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0109.905] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json")) returned 1 [0109.905] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fil\\messages.json")) returned 0xffffffff [0109.905] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0109.905] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0109.905] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0109.906] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0109.906] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.906] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0109.907] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0109.907] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0109.907] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0109.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0109.908] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0109.914] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0109.956] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbb, lpOverlapped=0x0) returned 1 [0109.957] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0109.957] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.071] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.075] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.082] CloseHandle (hObject=0x1a8) returned 1 [0110.082] CloseHandle (hObject=0x1ac) returned 1 [0110.082] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.083] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.083] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0110.083] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.083] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0110.083] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json")) returned 1 [0110.084] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr\\messages.json")) returned 0xffffffff [0110.084] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.084] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0110.084] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.084] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0110.084] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.084] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.084] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.084] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.085] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0110.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.085] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.094] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.136] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0110.136] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0110.137] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.151] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.155] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.162] CloseHandle (hObject=0x1ac) returned 1 [0110.162] CloseHandle (hObject=0x1a8) returned 1 [0110.162] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.163] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.163] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0110.163] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.163] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0110.163] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json")) returned 1 [0110.164] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\fr_ca\\messages.json")) returned 0xffffffff [0110.164] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.164] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.164] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.164] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0110.165] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.165] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.165] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.165] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.166] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac [0110.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.166] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.173] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.215] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xac, lpOverlapped=0x0) returned 1 [0110.216] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0110.217] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.232] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.235] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.242] CloseHandle (hObject=0x1a8) returned 1 [0110.242] CloseHandle (hObject=0x1ac) returned 1 [0110.242] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.243] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.243] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0110.243] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.243] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0110.243] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json")) returned 1 [0110.244] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gl\\messages.json")) returned 0xffffffff [0110.244] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.244] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.244] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.244] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0110.244] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.244] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.244] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.245] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.245] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0110.245] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.245] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.252] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.299] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x11e, lpOverlapped=0x0) returned 1 [0110.300] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0110.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.316] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.319] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.326] CloseHandle (hObject=0x1ac) returned 1 [0110.326] CloseHandle (hObject=0x1a8) returned 1 [0110.326] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.327] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.327] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0110.327] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.327] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.327] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json")) returned 1 [0110.328] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\gu\\messages.json")) returned 0xffffffff [0110.328] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.328] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0110.328] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.328] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0110.329] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.329] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.330] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.330] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.330] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0110.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.331] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.337] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.380] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x13e, lpOverlapped=0x0) returned 1 [0110.381] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x140, lpOverlapped=0x0) returned 1 [0110.382] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.397] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.400] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.407] CloseHandle (hObject=0x1a8) returned 1 [0110.407] CloseHandle (hObject=0x1ac) returned 1 [0110.407] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0110.408] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.408] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.408] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json")) returned 1 [0110.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hi\\messages.json")) returned 0xffffffff [0110.409] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.409] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0110.409] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.409] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0110.410] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.410] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.410] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0110.410] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.411] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.419] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.461] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc8, lpOverlapped=0x0) returned 1 [0110.462] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0110.463] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.479] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.482] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.489] CloseHandle (hObject=0x1ac) returned 1 [0110.489] CloseHandle (hObject=0x1a8) returned 1 [0110.489] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.490] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.490] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0110.490] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.490] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.490] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json")) returned 1 [0110.491] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hr\\messages.json")) returned 0xffffffff [0110.491] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.491] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0110.491] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.491] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0110.493] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.493] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.493] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.493] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.493] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0110.494] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.494] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.500] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.542] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc6, lpOverlapped=0x0) returned 1 [0110.543] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0110.544] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.559] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.569] CloseHandle (hObject=0x1a8) returned 1 [0110.569] CloseHandle (hObject=0x1ac) returned 1 [0110.570] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.570] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.570] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0110.570] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.570] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0110.570] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json")) returned 1 [0110.571] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hu\\messages.json")) returned 0xffffffff [0110.571] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.571] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.571] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.571] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0110.571] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.572] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.572] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.572] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.573] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x299 [0110.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.573] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.579] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.673] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x299, lpOverlapped=0x0) returned 1 [0110.687] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0110.688] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.704] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.707] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.714] CloseHandle (hObject=0x1ac) returned 1 [0110.714] CloseHandle (hObject=0x1a8) returned 1 [0110.714] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.715] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.715] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0110.715] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.715] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0110.715] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json")) returned 1 [0110.716] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\hy\\messages.json")) returned 0xffffffff [0110.716] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.716] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0110.716] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.716] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0110.717] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.717] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.717] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.718] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.718] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0110.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.718] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.725] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.767] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbb, lpOverlapped=0x0) returned 1 [0110.782] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0110.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.799] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.804] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.811] CloseHandle (hObject=0x1a8) returned 1 [0110.811] CloseHandle (hObject=0x1ac) returned 1 [0110.812] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.812] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.812] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0110.812] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.812] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0110.812] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json")) returned 1 [0110.813] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\id\\messages.json")) returned 0xffffffff [0110.813] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.813] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0110.813] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.813] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0110.814] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.814] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.814] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.814] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.815] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb2 [0110.815] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.815] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.822] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.865] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb2, lpOverlapped=0x0) returned 1 [0110.866] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0110.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0110.883] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0110.887] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.894] CloseHandle (hObject=0x1ac) returned 1 [0110.894] CloseHandle (hObject=0x1a8) returned 1 [0110.894] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0110.895] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0110.895] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0110.895] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0110.895] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0110.895] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json")) returned 1 [0110.896] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\is\\messages.json")) returned 0xffffffff [0110.896] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0110.896] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0110.896] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0110.896] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0110.899] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.899] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0110.899] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0110.899] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0110.900] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb6 [0110.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0110.901] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0110.907] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0110.951] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb6, lpOverlapped=0x0) returned 1 [0110.952] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0110.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.062] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.066] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.073] CloseHandle (hObject=0x1a8) returned 1 [0111.073] CloseHandle (hObject=0x1ac) returned 1 [0111.073] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.074] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.074] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0111.074] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.074] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0111.074] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json")) returned 1 [0111.075] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\it\\messages.json")) returned 0xffffffff [0111.075] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.075] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0111.075] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.075] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0111.075] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.075] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.075] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.075] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.076] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0111.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.076] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.083] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.128] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x16a, lpOverlapped=0x0) returned 1 [0111.129] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x170, lpOverlapped=0x0) returned 1 [0111.129] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.144] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.155] CloseHandle (hObject=0x1ac) returned 1 [0111.155] CloseHandle (hObject=0x1a8) returned 1 [0111.155] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.156] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0111.156] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.156] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0111.156] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json")) returned 1 [0111.157] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\iw\\messages.json")) returned 0xffffffff [0111.157] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.157] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0111.157] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.157] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0111.158] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.158] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.158] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.158] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.159] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb [0111.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.159] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.167] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.208] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfb, lpOverlapped=0x0) returned 1 [0111.209] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0111.210] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.224] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.228] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.235] CloseHandle (hObject=0x1a8) returned 1 [0111.235] CloseHandle (hObject=0x1ac) returned 1 [0111.235] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.235] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.235] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0111.236] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.236] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0111.236] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json")) returned 1 [0111.236] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ja\\messages.json")) returned 0xffffffff [0111.237] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.237] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0111.237] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.237] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0111.237] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.237] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.237] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.237] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.238] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x165 [0111.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.238] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.246] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.286] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x165, lpOverlapped=0x0) returned 1 [0111.289] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x170, lpOverlapped=0x0) returned 1 [0111.289] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.304] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.308] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.314] CloseHandle (hObject=0x1ac) returned 1 [0111.314] CloseHandle (hObject=0x1a8) returned 1 [0111.315] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0111.315] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.315] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0111.316] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json")) returned 1 [0111.319] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ka\\messages.json")) returned 0xffffffff [0111.319] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.319] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0111.319] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.319] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0111.320] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.320] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.320] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.320] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.321] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25f [0111.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.321] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.328] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.371] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x25f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x25f, lpOverlapped=0x0) returned 1 [0111.378] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x260, lpOverlapped=0x0) returned 1 [0111.379] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.394] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.397] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.404] CloseHandle (hObject=0x1a8) returned 1 [0111.404] CloseHandle (hObject=0x1ac) returned 1 [0111.404] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.405] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.405] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0111.405] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.405] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0111.405] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json")) returned 1 [0111.406] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\km\\messages.json")) returned 0xffffffff [0111.406] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.406] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0111.406] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.406] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0111.406] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.406] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.407] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.407] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.407] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x147 [0111.407] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.407] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.414] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.457] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x147, lpOverlapped=0x0) returned 1 [0111.458] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0111.459] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.474] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.478] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.485] CloseHandle (hObject=0x1ac) returned 1 [0111.485] CloseHandle (hObject=0x1a8) returned 1 [0111.485] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.486] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.486] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0111.486] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.486] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0111.486] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json")) returned 1 [0111.487] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\kn\\messages.json")) returned 0xffffffff [0111.487] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.487] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0111.487] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.487] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0111.488] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.488] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.488] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.489] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.489] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd9 [0111.489] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.489] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.498] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.538] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd9, lpOverlapped=0x0) returned 1 [0111.539] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0111.540] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.555] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.558] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.565] CloseHandle (hObject=0x1a8) returned 1 [0111.565] CloseHandle (hObject=0x1ac) returned 1 [0111.565] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.566] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.566] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0111.566] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.566] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0111.566] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json")) returned 1 [0111.567] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ko\\messages.json")) returned 0xffffffff [0111.567] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.567] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0111.567] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.567] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0111.567] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.567] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.567] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.567] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.568] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c2 [0111.568] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.568] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.576] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.616] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1c2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x1c2, lpOverlapped=0x0) returned 1 [0111.618] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x1d0, lpOverlapped=0x0) returned 1 [0111.619] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.634] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.643] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.649] CloseHandle (hObject=0x1ac) returned 1 [0111.649] CloseHandle (hObject=0x1a8) returned 1 [0111.650] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.651] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.651] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0111.651] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.651] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0111.651] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json")) returned 1 [0111.652] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lo\\messages.json")) returned 0xffffffff [0111.652] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.652] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0111.652] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.653] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0111.654] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.654] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.654] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.654] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.655] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5 [0111.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.655] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.662] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.705] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd5, lpOverlapped=0x0) returned 1 [0111.706] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0111.706] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.721] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.725] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.732] CloseHandle (hObject=0x1a8) returned 1 [0111.732] CloseHandle (hObject=0x1ac) returned 1 [0111.732] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.733] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.733] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0111.733] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.733] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0111.733] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json")) returned 1 [0111.734] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lt\\messages.json")) returned 0xffffffff [0111.734] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.734] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0111.734] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.734] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0111.734] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.734] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.734] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.734] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.735] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0111.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.735] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.741] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.783] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc6, lpOverlapped=0x0) returned 1 [0111.785] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0111.785] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.800] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.804] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.812] CloseHandle (hObject=0x1ac) returned 1 [0111.812] CloseHandle (hObject=0x1a8) returned 1 [0111.812] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.813] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.813] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0111.813] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.813] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0111.813] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json")) returned 1 [0111.814] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\lv\\messages.json")) returned 0xffffffff [0111.814] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.814] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0111.814] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.814] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0111.815] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.815] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.816] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.816] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.816] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x183 [0111.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.817] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.839] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0111.879] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x183, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x183, lpOverlapped=0x0) returned 1 [0111.888] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x190, lpOverlapped=0x0) returned 1 [0111.888] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0111.903] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0111.907] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.913] CloseHandle (hObject=0x1a8) returned 1 [0111.913] CloseHandle (hObject=0x1ac) returned 1 [0111.913] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0111.914] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0111.914] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0111.914] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0111.914] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0111.914] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json")) returned 1 [0111.915] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ml\\messages.json")) returned 0xffffffff [0111.915] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0111.915] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0111.915] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0111.915] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0111.915] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.915] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0111.915] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0111.916] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0111.916] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c3 [0111.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0111.917] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0111.923] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.065] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1c3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x1c3, lpOverlapped=0x0) returned 1 [0112.066] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x1d0, lpOverlapped=0x0) returned 1 [0112.066] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.081] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.085] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.091] CloseHandle (hObject=0x1ac) returned 1 [0112.091] CloseHandle (hObject=0x1a8) returned 1 [0112.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0112.092] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.092] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0112.092] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json")) returned 1 [0112.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mn\\messages.json")) returned 0xffffffff [0112.093] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.093] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0112.093] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.093] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0112.094] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.094] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.095] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.095] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.095] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0112.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.095] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.102] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.143] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x12c, lpOverlapped=0x0) returned 1 [0112.152] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0112.167] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.182] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.186] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.194] CloseHandle (hObject=0x1a8) returned 1 [0112.194] CloseHandle (hObject=0x1ac) returned 1 [0112.194] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.195] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.195] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0112.195] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.195] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0112.195] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json")) returned 1 [0112.196] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\mr\\messages.json")) returned 0xffffffff [0112.196] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.196] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0112.196] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.196] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0112.196] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.196] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.196] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.197] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.201] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb [0112.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.201] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.208] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.251] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcb, lpOverlapped=0x0) returned 1 [0112.252] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0112.252] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.267] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.271] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.279] CloseHandle (hObject=0x1ac) returned 1 [0112.279] CloseHandle (hObject=0x1a8) returned 1 [0112.279] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.280] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.280] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0112.280] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.281] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0112.281] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json")) returned 1 [0112.282] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ms\\messages.json")) returned 0xffffffff [0112.282] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.282] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0112.282] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.282] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0112.283] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.283] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.283] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.283] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.284] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20b [0112.284] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.284] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.291] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.333] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x20b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x20b, lpOverlapped=0x0) returned 1 [0112.333] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x210, lpOverlapped=0x0) returned 1 [0112.334] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.349] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.353] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.360] CloseHandle (hObject=0x1a8) returned 1 [0112.360] CloseHandle (hObject=0x1ac) returned 1 [0112.360] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.361] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.361] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0112.361] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.361] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0112.361] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json")) returned 1 [0112.362] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ne\\messages.json")) returned 0xffffffff [0112.362] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.362] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0112.362] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.362] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0112.362] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.362] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.362] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.362] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.363] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb1 [0112.363] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.363] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.371] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.412] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb1, lpOverlapped=0x0) returned 1 [0112.413] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0112.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.429] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.439] CloseHandle (hObject=0x1ac) returned 1 [0112.439] CloseHandle (hObject=0x1a8) returned 1 [0112.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.440] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0112.440] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.440] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0112.440] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json")) returned 1 [0112.441] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\nl\\messages.json")) returned 0xffffffff [0112.441] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.441] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0112.441] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.441] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0112.442] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.442] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.442] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.443] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.443] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x96 [0112.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.443] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.451] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.492] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x96, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x96, lpOverlapped=0x0) returned 1 [0112.493] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xa0, lpOverlapped=0x0) returned 1 [0112.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.509] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.513] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.519] CloseHandle (hObject=0x1a8) returned 1 [0112.519] CloseHandle (hObject=0x1ac) returned 1 [0112.519] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.520] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.520] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0112.520] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.520] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0112.520] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json")) returned 1 [0112.521] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\no\\messages.json")) returned 0xffffffff [0112.521] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.521] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0112.521] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.521] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0112.521] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.522] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.522] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.522] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.522] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0112.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.523] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.530] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.570] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb4, lpOverlapped=0x0) returned 1 [0112.571] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0112.572] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.586] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.590] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.596] CloseHandle (hObject=0x1ac) returned 1 [0112.596] CloseHandle (hObject=0x1a8) returned 1 [0112.596] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.597] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.597] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0112.597] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.597] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0112.598] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json")) returned 1 [0112.598] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pl\\messages.json")) returned 0xffffffff [0112.598] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.598] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0112.598] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.599] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0112.600] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.600] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.600] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.600] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.601] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0112.601] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.601] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.608] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.654] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbb, lpOverlapped=0x0) returned 1 [0112.655] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0112.656] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.671] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.674] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.681] CloseHandle (hObject=0x1a8) returned 1 [0112.681] CloseHandle (hObject=0x1ac) returned 1 [0112.681] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.682] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.682] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0112.682] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.682] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0112.682] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json")) returned 1 [0112.683] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0112.683] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.683] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0112.683] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.683] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0112.683] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.683] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.683] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.684] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.684] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc6 [0112.684] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.684] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.691] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.742] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc6, lpOverlapped=0x0) returned 1 [0112.746] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0112.747] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.761] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.765] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.771] CloseHandle (hObject=0x1ac) returned 1 [0112.771] CloseHandle (hObject=0x1a8) returned 1 [0112.772] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.772] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.772] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0112.772] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.772] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0112.772] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json")) returned 1 [0112.773] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0112.773] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.773] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0112.773] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.773] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0112.774] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.774] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.775] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.775] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.776] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf [0112.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.776] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.782] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.824] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xaf, lpOverlapped=0x0) returned 1 [0112.825] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0112.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.841] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.845] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.852] CloseHandle (hObject=0x1a8) returned 1 [0112.852] CloseHandle (hObject=0x1ac) returned 1 [0112.852] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.852] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.852] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0112.853] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.853] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0112.853] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json")) returned 1 [0112.854] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ro\\messages.json")) returned 0xffffffff [0112.854] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.854] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0112.854] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.854] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0112.854] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.854] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.855] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x119 [0112.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.855] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.862] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0112.905] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x119, lpOverlapped=0x0) returned 1 [0112.907] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0112.907] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0112.922] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0112.926] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.933] CloseHandle (hObject=0x1ac) returned 1 [0112.933] CloseHandle (hObject=0x1a8) returned 1 [0112.933] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0112.934] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0112.934] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0112.934] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0112.934] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0112.934] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json")) returned 1 [0112.935] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ru\\messages.json")) returned 0xffffffff [0112.935] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0112.935] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0112.935] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0112.935] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0112.936] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.936] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0112.937] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0112.937] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0112.937] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e [0112.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0112.938] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0112.944] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.115] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x14e, lpOverlapped=0x0) returned 1 [0113.116] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0113.116] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.132] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.136] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.143] CloseHandle (hObject=0x1a8) returned 1 [0113.143] CloseHandle (hObject=0x1ac) returned 1 [0113.144] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.144] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.144] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0113.144] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.145] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0113.145] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json")) returned 1 [0113.145] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\si\\messages.json")) returned 0xffffffff [0113.145] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.146] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0113.146] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.146] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0113.146] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.146] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.146] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.146] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.147] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5 [0113.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.147] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.179] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.225] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc5, lpOverlapped=0x0) returned 1 [0113.225] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0113.226] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.241] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.245] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.251] CloseHandle (hObject=0x1ac) returned 1 [0113.251] CloseHandle (hObject=0x1a8) returned 1 [0113.251] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.252] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.252] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0113.252] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.252] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0113.252] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json")) returned 1 [0113.253] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sk\\messages.json")) returned 0xffffffff [0113.253] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.253] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0113.253] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.253] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0113.255] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.255] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.256] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbe [0113.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.256] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.263] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.306] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xbe, lpOverlapped=0x0) returned 1 [0113.308] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0113.342] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.357] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.360] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.367] CloseHandle (hObject=0x1a8) returned 1 [0113.367] CloseHandle (hObject=0x1ac) returned 1 [0113.367] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.367] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.367] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0113.368] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.368] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0113.368] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json")) returned 1 [0113.368] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sl\\messages.json")) returned 0xffffffff [0113.368] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.368] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0113.369] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.369] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0113.389] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.389] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.389] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.390] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.390] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0113.390] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.391] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.397] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.444] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x104, lpOverlapped=0x0) returned 1 [0113.445] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0113.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.462] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.473] CloseHandle (hObject=0x1ac) returned 1 [0113.474] CloseHandle (hObject=0x1a8) returned 1 [0113.474] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.474] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.474] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0113.474] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.475] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0113.475] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json")) returned 1 [0113.475] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sr\\messages.json")) returned 0xffffffff [0113.475] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.475] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0113.476] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.476] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0113.477] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.477] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.477] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.477] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.478] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0113.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.478] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.485] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.551] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb3, lpOverlapped=0x0) returned 1 [0113.552] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0113.552] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.571] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.577] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.587] CloseHandle (hObject=0x1a8) returned 1 [0113.587] CloseHandle (hObject=0x1ac) returned 1 [0113.587] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.588] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.588] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0113.588] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.588] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0113.588] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json")) returned 1 [0113.590] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sv\\messages.json")) returned 0xffffffff [0113.590] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.590] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0113.590] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.590] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0113.590] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.590] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.590] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.591] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.591] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0113.591] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.592] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.601] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.654] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc4, lpOverlapped=0x0) returned 1 [0113.654] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0113.655] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.673] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.678] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.686] CloseHandle (hObject=0x1ac) returned 1 [0113.686] CloseHandle (hObject=0x1a8) returned 1 [0113.686] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.688] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.688] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0113.688] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.688] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0113.688] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json")) returned 1 [0113.689] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\sw\\messages.json")) returned 0xffffffff [0113.689] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.689] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0113.689] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.689] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0113.752] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.752] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.752] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.753] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.753] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150 [0113.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.754] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.760] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.806] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x150, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0113.807] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x160, lpOverlapped=0x0) returned 1 [0113.809] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.825] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.829] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.836] CloseHandle (hObject=0x1a8) returned 1 [0113.836] CloseHandle (hObject=0x1ac) returned 1 [0113.836] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.837] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0113.837] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.837] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0113.837] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json")) returned 1 [0113.838] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ta\\messages.json")) returned 0xffffffff [0113.838] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.838] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0113.838] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.838] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0113.838] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.838] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.839] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.839] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.840] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0113.840] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.840] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.847] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0113.889] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x115, lpOverlapped=0x0) returned 1 [0113.890] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0113.891] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0113.905] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0113.909] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0113.915] CloseHandle (hObject=0x1ac) returned 1 [0113.915] CloseHandle (hObject=0x1a8) returned 1 [0113.916] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0113.916] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0113.916] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0113.916] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0113.916] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0113.916] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json")) returned 1 [0113.918] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\te\\messages.json")) returned 0xffffffff [0113.918] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0113.918] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0113.918] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0113.918] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0113.919] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.919] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0113.919] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0113.919] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0113.920] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x125 [0113.920] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0113.920] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0113.927] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.059] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x125, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x125, lpOverlapped=0x0) returned 1 [0114.060] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0114.060] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.077] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.081] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.088] CloseHandle (hObject=0x1a8) returned 1 [0114.088] CloseHandle (hObject=0x1ac) returned 1 [0114.088] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.089] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.089] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0114.089] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.090] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0114.090] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json")) returned 1 [0114.091] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\th\\messages.json")) returned 0xffffffff [0114.091] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.091] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0114.091] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.091] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0114.091] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.091] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.091] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.092] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.092] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcd [0114.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.092] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.099] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.141] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xcd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xcd, lpOverlapped=0x0) returned 1 [0114.142] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0114.143] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.157] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.161] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.168] CloseHandle (hObject=0x1ac) returned 1 [0114.168] CloseHandle (hObject=0x1a8) returned 1 [0114.168] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.169] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.169] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0114.169] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.169] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0114.169] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json")) returned 1 [0114.170] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\tr\\messages.json")) returned 0xffffffff [0114.170] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.170] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0114.170] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.170] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0114.171] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.171] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.171] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.171] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.172] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x115 [0114.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.172] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.179] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.221] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x115, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x115, lpOverlapped=0x0) returned 1 [0114.222] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0114.222] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.237] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.241] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.247] CloseHandle (hObject=0x1a8) returned 1 [0114.247] CloseHandle (hObject=0x1ac) returned 1 [0114.248] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.248] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.248] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0114.248] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.248] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0114.248] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json")) returned 1 [0114.249] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\uk\\messages.json")) returned 0xffffffff [0114.249] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.249] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0114.249] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.249] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0114.250] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.250] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.250] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.250] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.250] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x177 [0114.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.251] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.257] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.302] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x177, lpOverlapped=0x0) returned 1 [0114.303] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x180, lpOverlapped=0x0) returned 1 [0114.304] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.319] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.323] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.335] CloseHandle (hObject=0x1ac) returned 1 [0114.335] CloseHandle (hObject=0x1a8) returned 1 [0114.335] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.336] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.336] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0114.336] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.336] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0114.336] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json")) returned 1 [0114.337] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\ur\\messages.json")) returned 0xffffffff [0114.337] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.337] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0114.337] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.337] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0114.338] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.338] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.339] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.339] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.340] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0114.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.340] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.347] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.396] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdd, lpOverlapped=0x0) returned 1 [0114.397] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0114.397] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.413] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.421] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.427] CloseHandle (hObject=0x1a8) returned 1 [0114.427] CloseHandle (hObject=0x1ac) returned 1 [0114.427] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.428] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.428] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0114.428] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.428] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0114.428] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json")) returned 1 [0114.429] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\vi\\messages.json")) returned 0xffffffff [0114.429] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.429] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0114.429] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.429] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0114.429] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.429] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.430] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.430] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.430] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0114.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.431] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.438] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.481] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0114.481] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xc0, lpOverlapped=0x0) returned 1 [0114.482] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.497] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.507] CloseHandle (hObject=0x1ac) returned 1 [0114.507] CloseHandle (hObject=0x1a8) returned 1 [0114.507] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.508] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.508] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0114.508] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.508] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0114.508] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json")) returned 1 [0114.509] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0114.509] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.509] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0114.509] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.509] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0114.511] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.511] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.512] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.512] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.513] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0114.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.513] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.520] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.562] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0114.563] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0114.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.580] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.584] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.590] CloseHandle (hObject=0x1a8) returned 1 [0114.590] CloseHandle (hObject=0x1ac) returned 1 [0114.591] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.591] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0114.591] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.591] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0114.591] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json")) returned 1 [0114.592] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_hk\\messages.json")) returned 0xffffffff [0114.592] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.592] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0114.592] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.592] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0114.592] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.592] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.593] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.593] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.593] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0114.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.594] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.600] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.648] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xaa, lpOverlapped=0x0) returned 1 [0114.650] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xb0, lpOverlapped=0x0) returned 1 [0114.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.666] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.670] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.676] CloseHandle (hObject=0x1ac) returned 1 [0114.676] CloseHandle (hObject=0x1a8) returned 1 [0114.677] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.678] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.678] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0114.678] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.678] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0114.678] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json")) returned 1 [0114.679] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0114.679] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.679] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0114.679] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.679] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0114.679] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.679] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0114.680] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0114.680] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.680] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc2 [0114.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.680] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.688] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.731] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xc2, lpOverlapped=0x0) returned 1 [0114.732] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xd0, lpOverlapped=0x0) returned 1 [0114.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.749] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.759] CloseHandle (hObject=0x1a8) returned 1 [0114.759] CloseHandle (hObject=0x1ac) returned 1 [0114.760] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.760] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.760] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0114.760] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0114.760] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0114.761] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json")) returned 1 [0114.762] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_locales\\zu\\messages.json")) returned 0xffffffff [0114.762] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0114.762] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0114.762] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0114.762] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0114.762] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0114.762] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534d00 [0114.762] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.762] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.762] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0114.763] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.773] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf3 [0114.774] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.774] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.781] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.824] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xaf3, lpOverlapped=0x0) returned 1 [0114.837] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0xb00, lpOverlapped=0x0) returned 1 [0114.838] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0114.856] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0114.860] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0114.866] CloseHandle (hObject=0x1a4) returned 1 [0114.866] CloseHandle (hObject=0x1ac) returned 1 [0114.884] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0114.885] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0114.885] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535040 [0114.885] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0114.885] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0114.885] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json")) returned 1 [0114.886] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\computed_hashes.json")) returned 0xffffffff [0114.886] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0114.886] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0114.887] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0114.906] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4454 [0114.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0114.910] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0114.917] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0114.963] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4454, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x4454, lpOverlapped=0x0) returned 1 [0115.047] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x4460, lpOverlapped=0x0) returned 1 [0115.048] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.063] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.066] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.073] CloseHandle (hObject=0x1ac) returned 1 [0115.073] CloseHandle (hObject=0x1a4) returned 1 [0115.073] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.074] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.074] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x5353c0 [0115.074] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.074] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0115.074] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json")) returned 1 [0115.075] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_1\\_metadata\\verified_contents.json")) returned 0xffffffff [0115.075] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0115.075] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0115.075] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0115.075] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0115.075] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0115.075] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0115.075] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0115.075] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535040 [0115.076] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0115.076] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0115.076] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x5351c0 [0115.088] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0115.088] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0115.088] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0115.089] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.090] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32a2e [0115.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.090] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.097] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.137] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x32a2e, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x32a2e, lpOverlapped=0x0) returned 1 [0115.156] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x32a30, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x32a30, lpOverlapped=0x0) returned 1 [0115.158] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.173] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.177] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.184] CloseHandle (hObject=0x1b0) returned 1 [0115.184] CloseHandle (hObject=0x1a4) returned 1 [0115.184] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.184] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.185] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534f00 [0115.185] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0115.185] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0115.185] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1 [0115.186] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 0xffffffff [0115.186] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0115.187] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.187] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0115.187] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b059 [0115.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.187] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.194] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.240] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3b059, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x3b059, lpOverlapped=0x0) returned 1 [0115.247] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3b060, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x3b060, lpOverlapped=0x0) returned 1 [0115.250] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.265] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.268] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.275] CloseHandle (hObject=0x1a4) returned 1 [0115.275] CloseHandle (hObject=0x1b0) returned 1 [0115.275] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.276] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.276] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534e40 [0115.276] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0115.276] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0115.276] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1 [0115.278] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 0xffffffff [0115.279] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0115.279] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535080 [0115.279] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.279] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.279] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.280] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.280] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6cd [0115.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.280] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.287] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.331] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6cd, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x6cd, lpOverlapped=0x0) returned 1 [0115.338] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x6d0, lpOverlapped=0x0) returned 1 [0115.339] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.354] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.357] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.364] CloseHandle (hObject=0x1a4) returned 1 [0115.364] CloseHandle (hObject=0x1ac) returned 1 [0115.364] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.365] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.365] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534f00 [0115.365] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.365] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0115.365] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1 [0115.366] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 0xffffffff [0115.366] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0115.366] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0115.366] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0115.366] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535080 [0115.369] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.369] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.369] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.369] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.370] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32a [0115.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.370] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.377] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.418] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x32a, lpOverlapped=0x0) returned 1 [0115.427] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x330, lpOverlapped=0x0) returned 1 [0115.428] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.443] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.501] CloseHandle (hObject=0x1ac) returned 1 [0115.501] CloseHandle (hObject=0x1a4) returned 1 [0115.501] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.502] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0115.502] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.502] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0115.502] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1 [0115.503] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 0xffffffff [0115.503] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0115.503] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0115.503] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0115.503] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534ec0 [0115.517] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.517] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.517] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.517] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.518] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112dc [0115.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.518] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.525] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.570] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x112dc, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x112dc, lpOverlapped=0x0) returned 1 [0115.581] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x112e0, lpOverlapped=0x0) returned 1 [0115.583] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.600] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.603] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.611] CloseHandle (hObject=0x1a4) returned 1 [0115.611] CloseHandle (hObject=0x1ac) returned 1 [0115.611] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.612] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.612] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534cc0 [0115.612] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.612] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0115.612] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 1 [0115.614] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 0xffffffff [0115.614] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.614] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.614] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.615] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1109 [0115.615] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.615] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.625] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.684] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x1109, lpOverlapped=0x0) returned 1 [0115.702] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x1110, lpOverlapped=0x0) returned 1 [0115.703] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.718] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.721] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.728] CloseHandle (hObject=0x1ac) returned 1 [0115.728] CloseHandle (hObject=0x1a4) returned 1 [0115.728] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.729] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.729] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0115.729] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.729] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0115.729] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0115.730] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0xffffffff [0115.730] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.730] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.735] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.735] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22c [0115.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.735] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.743] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.786] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x22c, lpOverlapped=0x0) returned 1 [0115.787] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x230, lpOverlapped=0x0) returned 1 [0115.787] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.802] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.807] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.814] CloseHandle (hObject=0x1a4) returned 1 [0115.814] CloseHandle (hObject=0x1ac) returned 1 [0115.814] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.815] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.815] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0115.815] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.815] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0115.815] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0115.816] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0xffffffff [0115.816] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.816] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.817] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.818] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0115.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.818] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.825] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.868] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xa0, lpOverlapped=0x0) returned 1 [0115.869] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0xb0, lpOverlapped=0x0) returned 1 [0115.869] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0115.885] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0115.889] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.896] CloseHandle (hObject=0x1ac) returned 1 [0115.896] CloseHandle (hObject=0x1a4) returned 1 [0115.896] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0115.897] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0115.897] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0115.897] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0115.897] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0115.897] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0115.898] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0xffffffff [0115.898] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0115.898] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0115.899] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0115.900] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc [0115.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0115.900] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0115.907] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0115.952] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xfc, lpOverlapped=0x0) returned 1 [0115.953] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x100, lpOverlapped=0x0) returned 1 [0115.954] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.055] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.059] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.066] CloseHandle (hObject=0x1a4) returned 1 [0116.066] CloseHandle (hObject=0x1ac) returned 1 [0116.067] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.067] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.067] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535300 [0116.067] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0116.067] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0116.067] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0116.068] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0xffffffff [0116.068] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.069] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.069] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0116.070] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0116.070] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.070] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.077] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.121] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xa0, lpOverlapped=0x0) returned 1 [0116.121] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0xb0, lpOverlapped=0x0) returned 1 [0116.122] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.138] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.142] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.148] CloseHandle (hObject=0x1ac) returned 1 [0116.148] CloseHandle (hObject=0x1a4) returned 1 [0116.148] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.149] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.149] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534cc0 [0116.149] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0116.149] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0116.149] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0116.150] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0xffffffff [0116.150] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.151] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0116.153] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.154] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa6 [0116.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.154] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.161] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.203] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xa6, lpOverlapped=0x0) returned 1 [0116.203] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0xb0, lpOverlapped=0x0) returned 1 [0116.204] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.219] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.223] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.230] CloseHandle (hObject=0x1a4) returned 1 [0116.230] CloseHandle (hObject=0x1ac) returned 1 [0116.230] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.231] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.231] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534e80 [0116.231] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0116.231] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0116.231] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0116.232] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0xffffffff [0116.232] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.232] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.233] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0116.233] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0 [0116.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.233] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.240] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.284] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xa0, lpOverlapped=0x0) returned 1 [0116.288] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0xb0, lpOverlapped=0x0) returned 1 [0116.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.333] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.336] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.344] CloseHandle (hObject=0x1ac) returned 1 [0116.344] CloseHandle (hObject=0x1a4) returned 1 [0116.344] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.345] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.345] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0116.345] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0116.345] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0116.345] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0116.346] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0xffffffff [0116.346] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0116.346] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0116.346] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0116.346] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0116.348] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0116.348] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52a [0116.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.348] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.356] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.399] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x52a, lpOverlapped=0x0) returned 1 [0116.405] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x530, lpOverlapped=0x0) returned 1 [0116.406] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.421] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.432] CloseHandle (hObject=0x1b0) returned 1 [0116.432] CloseHandle (hObject=0x1a4) returned 1 [0116.432] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.432] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.432] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5353c0 [0116.433] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0116.433] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0116.433] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 1 [0116.434] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 0xffffffff [0116.434] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0116.434] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534ec0 [0116.497] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.497] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.497] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0116.498] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.498] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.498] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.500] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0116.500] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x376 [0116.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.501] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.507] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.550] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x376, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x376, lpOverlapped=0x0) returned 1 [0116.552] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x380, lpOverlapped=0x0) returned 1 [0116.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.569] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.573] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.580] CloseHandle (hObject=0x1ac) returned 1 [0116.581] CloseHandle (hObject=0x1a8) returned 1 [0116.581] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.581] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.581] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0116.582] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0116.582] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0116.582] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 1 [0116.582] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0116.583] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0116.583] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0116.583] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.583] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0116.583] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.584] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.584] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0116.585] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.585] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c1 [0116.585] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.585] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.592] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.635] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2c1, lpOverlapped=0x0) returned 1 [0116.642] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2d0, lpOverlapped=0x0) returned 1 [0116.643] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.658] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.662] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.670] CloseHandle (hObject=0x1a8) returned 1 [0116.670] CloseHandle (hObject=0x1ac) returned 1 [0116.670] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.671] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.671] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0116.671] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0116.671] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0116.671] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 1 [0116.672] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0116.672] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0116.672] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0116.672] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.672] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0116.672] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.672] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.672] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.673] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0116.674] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x297 [0116.674] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.674] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.681] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.725] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x297, lpOverlapped=0x0) returned 1 [0116.726] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0116.727] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.742] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.746] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.752] CloseHandle (hObject=0x1ac) returned 1 [0116.752] CloseHandle (hObject=0x1a8) returned 1 [0116.753] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.753] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.753] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0116.753] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0116.753] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0116.753] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 1 [0116.754] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0116.754] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0116.754] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0116.754] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.754] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0116.755] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.756] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.756] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0116.757] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.758] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0116.758] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.758] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.765] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.809] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x282, lpOverlapped=0x0) returned 1 [0116.810] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0116.810] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.826] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.830] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.836] CloseHandle (hObject=0x1a8) returned 1 [0116.837] CloseHandle (hObject=0x1ac) returned 1 [0116.837] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.837] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0116.838] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0116.838] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0116.838] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 1 [0116.838] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 0xffffffff [0116.838] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0116.839] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0116.839] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.839] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0116.843] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.843] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.843] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.843] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0116.844] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bd [0116.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.844] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.851] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0116.894] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2bd, lpOverlapped=0x0) returned 1 [0116.896] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2c0, lpOverlapped=0x0) returned 1 [0116.896] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0116.912] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0116.915] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.922] CloseHandle (hObject=0x1ac) returned 1 [0116.922] CloseHandle (hObject=0x1a8) returned 1 [0116.922] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0116.923] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0116.923] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0116.923] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0116.923] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0116.923] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 1 [0116.924] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 0xffffffff [0116.924] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0116.924] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0116.924] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0116.924] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0116.927] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.927] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0116.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0116.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0116.928] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x36b [0116.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0116.928] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0116.935] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.067] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x36b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x36b, lpOverlapped=0x0) returned 1 [0117.068] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x370, lpOverlapped=0x0) returned 1 [0117.068] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.085] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.089] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.097] CloseHandle (hObject=0x1a8) returned 1 [0117.097] CloseHandle (hObject=0x1ac) returned 1 [0117.097] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.098] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.098] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0117.098] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.098] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0117.098] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 1 [0117.099] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 0xffffffff [0117.099] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.099] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0117.099] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.099] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0117.099] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.099] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.100] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.100] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.100] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0117.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.101] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.109] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.153] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x269, lpOverlapped=0x0) returned 1 [0117.154] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x270, lpOverlapped=0x0) returned 1 [0117.155] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.170] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.174] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.181] CloseHandle (hObject=0x1ac) returned 1 [0117.181] CloseHandle (hObject=0x1a8) returned 1 [0117.181] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.182] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.182] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0117.182] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.182] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0117.182] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 1 [0117.183] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 0xffffffff [0117.183] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.183] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0117.184] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.184] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0117.184] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.184] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.184] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.184] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.185] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0117.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.185] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.192] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.237] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x269, lpOverlapped=0x0) returned 1 [0117.256] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x270, lpOverlapped=0x0) returned 1 [0117.257] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.272] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.276] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.283] CloseHandle (hObject=0x1a8) returned 1 [0117.283] CloseHandle (hObject=0x1ac) returned 1 [0117.283] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.284] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.284] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0117.284] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.284] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0117.284] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 1 [0117.285] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 0xffffffff [0117.285] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.285] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0117.285] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.285] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0117.286] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.286] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.286] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.287] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.287] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b8 [0117.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.287] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.296] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.339] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2b8, lpOverlapped=0x0) returned 1 [0117.366] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2c0, lpOverlapped=0x0) returned 1 [0117.367] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.382] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.385] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.393] CloseHandle (hObject=0x1ac) returned 1 [0117.393] CloseHandle (hObject=0x1a8) returned 1 [0117.393] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.394] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.394] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0117.394] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.394] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0117.394] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 1 [0117.395] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 0xffffffff [0117.395] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.395] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0117.395] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.395] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0117.395] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.395] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.396] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.396] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.396] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0117.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.396] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.404] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.448] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x29b, lpOverlapped=0x0) returned 1 [0117.455] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0117.456] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.471] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.475] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.482] CloseHandle (hObject=0x1a8) returned 1 [0117.482] CloseHandle (hObject=0x1ac) returned 1 [0117.482] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.483] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.483] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0117.483] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.483] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0117.483] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 1 [0117.484] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 0xffffffff [0117.484] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.485] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0117.485] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.485] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0117.486] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.486] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.486] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.486] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.487] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x261 [0117.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.487] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.495] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.537] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x261, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x261, lpOverlapped=0x0) returned 1 [0117.551] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x270, lpOverlapped=0x0) returned 1 [0117.552] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.568] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.571] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.580] CloseHandle (hObject=0x1ac) returned 1 [0117.580] CloseHandle (hObject=0x1a8) returned 1 [0117.580] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.581] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.581] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0117.581] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.581] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0117.581] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 1 [0117.582] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 0xffffffff [0117.582] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.582] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0117.582] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.582] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0117.583] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.583] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.584] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a1 [0117.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.584] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.591] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.634] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2a1, lpOverlapped=0x0) returned 1 [0117.635] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2b0, lpOverlapped=0x0) returned 1 [0117.642] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.657] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.661] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.690] CloseHandle (hObject=0x1a8) returned 1 [0117.690] CloseHandle (hObject=0x1ac) returned 1 [0117.690] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.691] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.691] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0117.691] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.691] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0117.691] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 1 [0117.692] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0117.692] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.692] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0117.692] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0117.692] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.692] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.692] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.693] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.693] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b4 [0117.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.693] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.701] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.743] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2b4, lpOverlapped=0x0) returned 1 [0117.744] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2c0, lpOverlapped=0x0) returned 1 [0117.745] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.760] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.770] CloseHandle (hObject=0x1ac) returned 1 [0117.770] CloseHandle (hObject=0x1a8) returned 1 [0117.770] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.771] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.771] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0117.771] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.771] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0117.771] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 1 [0117.772] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0117.772] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.772] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0117.772] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.772] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0117.772] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.772] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.773] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.773] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.773] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c4 [0117.773] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.774] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.781] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.825] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2c4, lpOverlapped=0x0) returned 1 [0117.826] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2d0, lpOverlapped=0x0) returned 1 [0117.827] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.846] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.851] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.860] CloseHandle (hObject=0x1a8) returned 1 [0117.860] CloseHandle (hObject=0x1ac) returned 1 [0117.861] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.861] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.861] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0117.862] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.862] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0117.862] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 1 [0117.863] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0117.863] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.863] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0117.863] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.863] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0117.864] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.865] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.865] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.865] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.867] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ad [0117.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.867] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0117.874] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0117.923] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3ad, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3ad, lpOverlapped=0x0) returned 1 [0117.925] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3b0, lpOverlapped=0x0) returned 1 [0117.926] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0117.946] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0117.950] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.956] CloseHandle (hObject=0x1ac) returned 1 [0117.957] CloseHandle (hObject=0x1a8) returned 1 [0117.957] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0117.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0117.957] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0117.957] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0117.958] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0117.958] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 1 [0117.958] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0117.959] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0117.959] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0117.959] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0117.959] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0117.959] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.959] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0117.959] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0117.960] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0117.961] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x279 [0117.961] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0117.961] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.054] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.098] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x279, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x279, lpOverlapped=0x0) returned 1 [0118.099] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x280, lpOverlapped=0x0) returned 1 [0118.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.115] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.118] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.126] CloseHandle (hObject=0x1a8) returned 1 [0118.126] CloseHandle (hObject=0x1ac) returned 1 [0118.126] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.127] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.127] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0118.127] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.127] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0118.127] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 1 [0118.128] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0118.128] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.128] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0118.128] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0118.130] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.130] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.130] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.131] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.131] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c6 [0118.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.182] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2c6, lpOverlapped=0x0) returned 1 [0118.183] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2d0, lpOverlapped=0x0) returned 1 [0118.184] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.199] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.210] CloseHandle (hObject=0x1ac) returned 1 [0118.210] CloseHandle (hObject=0x1a8) returned 1 [0118.210] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.211] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0118.211] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.211] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0118.211] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 1 [0118.212] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0118.212] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.212] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0118.212] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.212] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0118.213] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.213] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.213] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.213] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.214] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x269 [0118.214] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.215] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.222] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.264] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x269, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x269, lpOverlapped=0x0) returned 1 [0118.287] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x270, lpOverlapped=0x0) returned 1 [0118.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.314] CloseHandle (hObject=0x1a8) returned 1 [0118.314] CloseHandle (hObject=0x1ac) returned 1 [0118.314] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0118.315] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.315] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0118.315] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 1 [0118.316] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 0xffffffff [0118.316] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.316] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0118.316] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.316] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0118.318] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.318] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.318] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.319] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.319] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26e [0118.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.319] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.326] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.369] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x26e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x26e, lpOverlapped=0x0) returned 1 [0118.371] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x270, lpOverlapped=0x0) returned 1 [0118.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.387] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.391] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.397] CloseHandle (hObject=0x1ac) returned 1 [0118.397] CloseHandle (hObject=0x1a8) returned 1 [0118.397] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.398] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.398] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0118.398] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.398] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0118.398] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 1 [0118.399] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 0xffffffff [0118.399] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.399] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0118.399] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.399] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0118.403] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.403] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.403] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.404] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.404] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30a [0118.404] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.405] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.411] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.454] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x30a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x30a, lpOverlapped=0x0) returned 1 [0118.456] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x310, lpOverlapped=0x0) returned 1 [0118.456] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.472] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.475] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.482] CloseHandle (hObject=0x1a8) returned 1 [0118.482] CloseHandle (hObject=0x1ac) returned 1 [0118.482] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.483] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.483] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0118.483] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.483] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0118.483] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 1 [0118.484] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0118.484] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.484] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0118.484] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.484] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f00 [0118.485] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.485] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.486] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.486] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.490] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29d [0118.490] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.490] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.497] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.541] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29d, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x29d, lpOverlapped=0x0) returned 1 [0118.542] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0118.543] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.559] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.562] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.569] CloseHandle (hObject=0x1ac) returned 1 [0118.569] CloseHandle (hObject=0x1a8) returned 1 [0118.569] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.570] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.570] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0118.570] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.570] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0118.570] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 1 [0118.571] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0118.571] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.571] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0118.572] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.572] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0118.572] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.572] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.572] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.572] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.573] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ae [0118.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.575] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.583] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.626] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2ae, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2ae, lpOverlapped=0x0) returned 1 [0118.627] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2b0, lpOverlapped=0x0) returned 1 [0118.628] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.649] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.653] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.660] CloseHandle (hObject=0x1a8) returned 1 [0118.660] CloseHandle (hObject=0x1ac) returned 1 [0118.660] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.661] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0118.661] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.661] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0118.661] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 1 [0118.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0118.662] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.662] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0118.662] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0118.662] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.662] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.664] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.665] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bb [0118.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.665] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.672] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.727] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2bb, lpOverlapped=0x0) returned 1 [0118.737] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2c0, lpOverlapped=0x0) returned 1 [0118.737] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.756] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.759] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.765] CloseHandle (hObject=0x1ac) returned 1 [0118.766] CloseHandle (hObject=0x1a8) returned 1 [0118.766] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.766] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.766] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0118.766] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.766] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0118.767] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 1 [0118.768] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0118.768] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.768] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0118.768] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.768] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0118.768] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.769] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.769] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.769] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.769] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x284 [0118.769] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.770] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.776] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.818] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x284, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x284, lpOverlapped=0x0) returned 1 [0118.820] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0118.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.835] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.839] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.847] CloseHandle (hObject=0x1a8) returned 1 [0118.847] CloseHandle (hObject=0x1ac) returned 1 [0118.847] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.848] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.848] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0118.848] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.848] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0118.848] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 1 [0118.849] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 0xffffffff [0118.849] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.849] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0118.849] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.849] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0118.850] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.850] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.850] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.850] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.851] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0118.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.851] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.858] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0118.899] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x282, lpOverlapped=0x0) returned 1 [0118.901] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0118.901] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0118.916] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0118.920] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.927] CloseHandle (hObject=0x1ac) returned 1 [0118.927] CloseHandle (hObject=0x1a8) returned 1 [0118.927] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0118.928] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0118.928] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0118.928] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0118.928] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0118.928] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 1 [0118.929] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0118.929] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0118.929] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0118.929] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0118.929] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0118.932] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.932] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0118.932] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0118.932] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0118.933] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29a [0118.933] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0118.933] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0118.940] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.076] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x29a, lpOverlapped=0x0) returned 1 [0119.079] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0119.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.115] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.118] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.125] CloseHandle (hObject=0x1a8) returned 1 [0119.125] CloseHandle (hObject=0x1ac) returned 1 [0119.125] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.126] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0119.126] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.126] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0119.126] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 1 [0119.128] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0119.128] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.128] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0119.128] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.129] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0119.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.130] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.130] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.131] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29b [0119.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.180] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x29b, lpOverlapped=0x0) returned 1 [0119.181] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0119.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.196] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.200] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.207] CloseHandle (hObject=0x1ac) returned 1 [0119.207] CloseHandle (hObject=0x1a8) returned 1 [0119.207] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.207] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.208] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0119.208] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.208] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0119.208] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 1 [0119.209] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0119.209] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.209] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0119.209] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0119.209] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.209] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.209] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.210] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.211] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x295 [0119.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.211] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.218] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.260] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x295, lpOverlapped=0x0) returned 1 [0119.262] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0119.263] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.278] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.281] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.288] CloseHandle (hObject=0x1a8) returned 1 [0119.288] CloseHandle (hObject=0x1ac) returned 1 [0119.288] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.289] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.289] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0119.289] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.289] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0119.289] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 1 [0119.290] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0119.290] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.290] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0119.290] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.290] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0119.290] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.290] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.290] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.290] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.291] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29c [0119.291] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.291] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.298] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.354] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x29c, lpOverlapped=0x0) returned 1 [0119.355] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0119.356] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.372] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.375] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.382] CloseHandle (hObject=0x1ac) returned 1 [0119.382] CloseHandle (hObject=0x1a8) returned 1 [0119.382] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.383] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.383] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0119.383] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.383] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0119.383] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 1 [0119.384] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0119.384] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.384] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0119.384] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.384] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0119.384] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.384] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.385] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.389] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.390] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x30f [0119.390] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.390] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.397] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.438] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x30f, lpOverlapped=0x0) returned 1 [0119.439] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x310, lpOverlapped=0x0) returned 1 [0119.440] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.455] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.458] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.465] CloseHandle (hObject=0x1a8) returned 1 [0119.465] CloseHandle (hObject=0x1ac) returned 1 [0119.465] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.465] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.465] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0119.466] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.466] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0119.466] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 1 [0119.466] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0119.467] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.467] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0119.467] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.467] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0119.467] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.467] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.468] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29f [0119.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.468] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.477] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.523] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x29f, lpOverlapped=0x0) returned 1 [0119.525] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2a0, lpOverlapped=0x0) returned 1 [0119.525] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.540] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.544] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.550] CloseHandle (hObject=0x1ac) returned 1 [0119.550] CloseHandle (hObject=0x1a8) returned 1 [0119.551] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.551] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.551] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0119.551] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.551] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0119.551] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 1 [0119.552] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0119.552] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.552] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0119.552] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.552] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0119.553] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.553] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.554] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.555] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.555] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0119.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.555] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.562] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.603] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x282, lpOverlapped=0x0) returned 1 [0119.604] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0119.605] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.620] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.624] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.632] CloseHandle (hObject=0x1a8) returned 1 [0119.632] CloseHandle (hObject=0x1ac) returned 1 [0119.632] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.633] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.633] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0119.633] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.633] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0119.633] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 1 [0119.634] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0119.634] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.634] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0119.634] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.635] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0119.635] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.635] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.635] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.635] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.636] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32c [0119.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.641] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.649] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.691] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x32c, lpOverlapped=0x0) returned 1 [0119.692] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x330, lpOverlapped=0x0) returned 1 [0119.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.711] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.715] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.722] CloseHandle (hObject=0x1ac) returned 1 [0119.722] CloseHandle (hObject=0x1a8) returned 1 [0119.723] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.723] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.723] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0119.723] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.723] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0119.724] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 1 [0119.724] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0119.724] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.725] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0119.725] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.725] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0119.725] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.725] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.725] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.726] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.727] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x289 [0119.727] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.727] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.734] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.776] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x289, lpOverlapped=0x0) returned 1 [0119.777] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0119.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.793] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.797] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.804] CloseHandle (hObject=0x1a8) returned 1 [0119.804] CloseHandle (hObject=0x1ac) returned 1 [0119.804] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.805] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.805] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0119.805] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.805] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0119.805] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 1 [0119.806] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0119.806] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.806] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0119.806] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.806] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0119.806] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.806] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.807] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.807] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.807] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44b [0119.807] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.808] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.815] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.856] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x44b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x44b, lpOverlapped=0x0) returned 1 [0119.870] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x450, lpOverlapped=0x0) returned 1 [0119.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.886] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0119.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.897] CloseHandle (hObject=0x1ac) returned 1 [0119.897] CloseHandle (hObject=0x1a8) returned 1 [0119.897] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0119.897] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0119.898] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0119.898] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0119.898] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0119.898] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 1 [0119.899] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 0xffffffff [0119.899] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0119.899] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0119.899] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0119.899] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0119.899] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.899] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0119.899] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0119.900] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0119.900] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28a [0119.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0119.900] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0119.908] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0119.949] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x28a, lpOverlapped=0x0) returned 1 [0119.952] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0119.953] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0119.968] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.062] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.068] CloseHandle (hObject=0x1a8) returned 1 [0120.068] CloseHandle (hObject=0x1ac) returned 1 [0120.069] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.069] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.069] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0120.069] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0120.069] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0120.069] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 1 [0120.070] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0120.070] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0120.070] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0120.070] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0120.070] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0120.071] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.071] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.071] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.071] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0120.072] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x315 [0120.072] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.072] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.082] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0120.127] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x315, lpOverlapped=0x0) returned 1 [0120.128] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x320, lpOverlapped=0x0) returned 1 [0120.129] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0120.143] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.147] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.154] CloseHandle (hObject=0x1ac) returned 1 [0120.154] CloseHandle (hObject=0x1a8) returned 1 [0120.154] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.155] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.155] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0120.155] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0120.155] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0120.155] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 1 [0120.156] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0120.156] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0120.156] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0120.156] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0120.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0120.157] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.157] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.157] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0120.157] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.158] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d0 [0120.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.158] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.165] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0120.208] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x2d0, lpOverlapped=0x0) returned 1 [0120.213] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x2e0, lpOverlapped=0x0) returned 1 [0120.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0120.233] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.238] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.247] CloseHandle (hObject=0x1a8) returned 1 [0120.247] CloseHandle (hObject=0x1ac) returned 1 [0120.247] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.248] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.248] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0120.248] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0120.248] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0120.248] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 1 [0120.252] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0120.252] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0120.252] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0120.252] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0120.252] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0120.252] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.252] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.252] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.253] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0120.253] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x253 [0120.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.254] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.262] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0120.319] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x253, lpOverlapped=0x0) returned 1 [0120.320] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x260, lpOverlapped=0x0) returned 1 [0120.321] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0120.336] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.339] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.360] CloseHandle (hObject=0x1ac) returned 1 [0120.360] CloseHandle (hObject=0x1a8) returned 1 [0120.360] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.360] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.361] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0120.361] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0120.361] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0120.361] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 1 [0120.362] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0120.362] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0120.362] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0120.362] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0120.362] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0120.362] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.362] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0120.363] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0120.363] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.363] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x280 [0120.363] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.364] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.370] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0120.459] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x280, lpOverlapped=0x0) returned 1 [0120.460] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x290, lpOverlapped=0x0) returned 1 [0120.461] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0120.477] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.481] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.488] CloseHandle (hObject=0x1a8) returned 1 [0120.488] CloseHandle (hObject=0x1ac) returned 1 [0120.488] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.489] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.489] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0120.489] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0120.489] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0120.489] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 1 [0120.490] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0120.490] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0120.490] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0120.490] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0120.490] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0120.490] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0120.490] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535240 [0120.490] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0120.491] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0120.491] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0120.491] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.554] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dfa [0120.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.555] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.562] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0120.605] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2dfa, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2dfa, lpOverlapped=0x0) returned 1 [0120.696] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2e00, lpOverlapped=0x0) returned 1 [0120.697] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0120.715] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.719] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.725] CloseHandle (hObject=0x1b0) returned 1 [0120.725] CloseHandle (hObject=0x1ac) returned 1 [0120.725] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.726] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.726] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535300 [0120.726] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0120.726] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0120.726] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 1 [0120.727] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0120.727] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0120.727] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0120.727] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0120.727] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0120.727] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0120.727] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0120.727] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0120.727] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e40 [0120.727] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0120.727] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0120.727] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x534d00 [0120.736] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0120.736] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0120.736] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0120.736] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.737] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x180f [0120.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.737] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.744] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0120.785] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x180f, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x180f, lpOverlapped=0x0) returned 1 [0120.907] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x1810, lpOverlapped=0x0) returned 1 [0120.907] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0120.923] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0120.927] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.933] CloseHandle (hObject=0x1a4) returned 1 [0120.933] CloseHandle (hObject=0x1ac) returned 1 [0120.934] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0120.934] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0120.934] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0120.934] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0120.934] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0120.934] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0120.935] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0xffffffff [0120.935] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0120.936] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0120.936] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0120.936] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x310 [0120.936] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0120.937] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0120.943] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.064] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x310, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x310, lpOverlapped=0x0) returned 1 [0121.066] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x320, lpOverlapped=0x0) returned 1 [0121.066] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.081] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.085] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.091] CloseHandle (hObject=0x1ac) returned 1 [0121.091] CloseHandle (hObject=0x1a4) returned 1 [0121.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0121.092] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0121.092] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0121.092] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 1 [0121.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 0xffffffff [0121.094] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0121.094] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534f40 [0121.104] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.104] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.104] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0121.105] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.105] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.105] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.106] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.107] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x138 [0121.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.107] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.115] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.158] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x138, lpOverlapped=0x0) returned 1 [0121.159] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x140, lpOverlapped=0x0) returned 1 [0121.160] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.176] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.180] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.186] CloseHandle (hObject=0x1b0) returned 1 [0121.186] CloseHandle (hObject=0x1a8) returned 1 [0121.187] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.187] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.188] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0121.188] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.188] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0121.188] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 1 [0121.189] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0121.189] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.189] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0121.189] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.189] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0121.189] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.189] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.189] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.190] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.191] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124 [0121.191] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.191] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.198] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.241] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x124, lpOverlapped=0x0) returned 1 [0121.242] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0121.243] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.257] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.261] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.268] CloseHandle (hObject=0x1a8) returned 1 [0121.268] CloseHandle (hObject=0x1b0) returned 1 [0121.268] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.268] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.268] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0121.269] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.269] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0121.269] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 1 [0121.269] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0121.269] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.269] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0121.270] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.270] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0121.271] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.271] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.271] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.272] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.272] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfe [0121.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.272] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.279] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.321] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfe, lpOverlapped=0x0) returned 1 [0121.322] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0121.322] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.337] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.341] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.347] CloseHandle (hObject=0x1b0) returned 1 [0121.347] CloseHandle (hObject=0x1a8) returned 1 [0121.347] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.348] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.348] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0121.348] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.348] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0121.348] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 1 [0121.352] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0121.352] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.352] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0121.352] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.352] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0121.353] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.353] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.353] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.354] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.355] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0121.355] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.355] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.362] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.403] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf9, lpOverlapped=0x0) returned 1 [0121.404] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0121.404] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.419] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.423] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.430] CloseHandle (hObject=0x1a8) returned 1 [0121.430] CloseHandle (hObject=0x1b0) returned 1 [0121.430] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.430] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.430] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0121.431] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.431] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0121.431] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 1 [0121.431] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0121.432] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.432] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0121.432] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.432] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0121.432] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.433] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.433] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.433] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.433] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec [0121.433] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.434] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.441] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.482] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xec, lpOverlapped=0x0) returned 1 [0121.482] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0121.483] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.501] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.504] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.511] CloseHandle (hObject=0x1b0) returned 1 [0121.511] CloseHandle (hObject=0x1a8) returned 1 [0121.511] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.512] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.512] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0121.512] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.512] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0121.512] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 1 [0121.513] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0xffffffff [0121.513] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.513] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0121.513] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.513] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0121.514] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.514] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.514] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.515] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.515] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xef [0121.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.515] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.522] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.565] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xef, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xef, lpOverlapped=0x0) returned 1 [0121.566] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0121.566] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.581] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.585] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.592] CloseHandle (hObject=0x1a8) returned 1 [0121.592] CloseHandle (hObject=0x1b0) returned 1 [0121.592] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.593] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.593] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0121.595] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.595] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0121.595] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 1 [0121.596] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0xffffffff [0121.596] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.596] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0121.596] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.596] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0121.600] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.600] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.600] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.601] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.602] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c [0121.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.602] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.609] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.656] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x14c, lpOverlapped=0x0) returned 1 [0121.657] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0121.657] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.673] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.676] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.685] CloseHandle (hObject=0x1b0) returned 1 [0121.685] CloseHandle (hObject=0x1a8) returned 1 [0121.685] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.686] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.686] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0121.690] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.690] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0121.690] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 1 [0121.691] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0xffffffff [0121.692] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.692] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0121.692] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0121.692] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.692] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.692] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.692] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.693] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7 [0121.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.693] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.700] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.744] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd7, lpOverlapped=0x0) returned 1 [0121.745] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0121.745] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.760] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.764] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.770] CloseHandle (hObject=0x1a8) returned 1 [0121.770] CloseHandle (hObject=0x1b0) returned 1 [0121.771] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.771] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.771] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0121.771] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.771] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0121.771] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 1 [0121.772] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0xffffffff [0121.772] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.772] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0121.772] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.772] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0121.773] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.773] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.773] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.773] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.774] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10d [0121.774] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.774] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.782] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.822] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10d, lpOverlapped=0x0) returned 1 [0121.825] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0121.837] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.866] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.870] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.877] CloseHandle (hObject=0x1b0) returned 1 [0121.877] CloseHandle (hObject=0x1a8) returned 1 [0121.877] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.878] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.878] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0121.878] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.878] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0121.878] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 1 [0121.879] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0xffffffff [0121.879] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.879] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0121.879] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.879] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0121.880] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.880] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.880] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.881] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.881] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0121.881] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.881] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0121.888] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0121.930] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0121.932] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0121.933] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0121.948] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0121.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.958] CloseHandle (hObject=0x1a8) returned 1 [0121.959] CloseHandle (hObject=0x1b0) returned 1 [0121.959] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0121.959] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0121.959] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0121.960] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0121.960] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0121.960] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 1 [0121.960] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0121.960] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0121.960] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0121.961] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0121.961] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0121.961] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.961] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0121.962] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0121.963] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0121.963] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0121.963] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0121.964] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.068] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.109] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xea, lpOverlapped=0x0) returned 1 [0122.110] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0122.111] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.125] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.129] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.135] CloseHandle (hObject=0x1b0) returned 1 [0122.136] CloseHandle (hObject=0x1a8) returned 1 [0122.136] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.136] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.137] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0122.137] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.137] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0122.137] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 1 [0122.138] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0122.138] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.138] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0122.138] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.138] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0122.138] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.138] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.138] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.139] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.140] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0122.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.140] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.147] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.190] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10c, lpOverlapped=0x0) returned 1 [0122.191] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0122.191] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.206] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.210] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.216] CloseHandle (hObject=0x1a8) returned 1 [0122.216] CloseHandle (hObject=0x1b0) returned 1 [0122.216] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.217] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.217] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f00 [0122.217] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.217] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0122.217] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 1 [0122.218] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0122.218] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.218] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0122.219] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.219] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0122.219] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.219] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.219] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.220] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.221] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0122.221] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.221] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.228] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.277] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x121, lpOverlapped=0x0) returned 1 [0122.279] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0122.280] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.295] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.299] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.306] CloseHandle (hObject=0x1b0) returned 1 [0122.306] CloseHandle (hObject=0x1a8) returned 1 [0122.306] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.306] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.307] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5351c0 [0122.307] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.307] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0122.307] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 1 [0122.308] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0122.308] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.308] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0122.308] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.308] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534ec0 [0122.308] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.308] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.308] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.308] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.309] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0122.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.309] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.317] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.361] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe6, lpOverlapped=0x0) returned 1 [0122.361] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0122.362] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.378] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.382] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.389] CloseHandle (hObject=0x1a8) returned 1 [0122.389] CloseHandle (hObject=0x1b0) returned 1 [0122.389] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.390] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.390] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0122.390] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.390] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0122.390] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 1 [0122.392] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0122.392] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.392] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0122.392] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.392] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0122.392] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.392] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.392] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.393] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.393] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0122.393] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.394] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.402] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.451] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe2, lpOverlapped=0x0) returned 1 [0122.452] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0122.453] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.469] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.472] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.479] CloseHandle (hObject=0x1b0) returned 1 [0122.479] CloseHandle (hObject=0x1a8) returned 1 [0122.479] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.480] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.480] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0122.480] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.480] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0122.480] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 1 [0122.481] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0122.481] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.481] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0122.481] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.481] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0122.481] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.481] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.481] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.482] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.482] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0122.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.482] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.490] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.533] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf2, lpOverlapped=0x0) returned 1 [0122.533] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0122.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.549] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.559] CloseHandle (hObject=0x1a8) returned 1 [0122.559] CloseHandle (hObject=0x1b0) returned 1 [0122.559] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.560] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.560] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0122.560] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.560] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0122.560] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 1 [0122.561] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 0xffffffff [0122.561] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.561] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0122.561] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0122.562] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.562] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.562] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.562] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.563] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0122.563] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.563] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.570] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.614] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0122.615] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0122.615] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.630] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.634] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.645] CloseHandle (hObject=0x1b0) returned 1 [0122.645] CloseHandle (hObject=0x1a8) returned 1 [0122.646] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0122.646] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.646] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0122.646] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 1 [0122.647] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 0xffffffff [0122.647] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.647] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0122.647] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.647] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0122.648] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.648] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.648] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.648] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.649] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10f [0122.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.649] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.656] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.697] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x10f, lpOverlapped=0x0) returned 1 [0122.699] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0122.700] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.716] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.726] CloseHandle (hObject=0x1a8) returned 1 [0122.726] CloseHandle (hObject=0x1b0) returned 1 [0122.727] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.727] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.727] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0122.727] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.727] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0122.728] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 1 [0122.728] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0122.729] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.729] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0122.729] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.729] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0122.729] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.729] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.729] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.730] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.730] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100 [0122.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.731] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.738] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.778] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0122.781] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0122.781] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.796] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.800] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.806] CloseHandle (hObject=0x1b0) returned 1 [0122.806] CloseHandle (hObject=0x1a8) returned 1 [0122.806] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0122.807] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.807] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0122.807] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 1 [0122.808] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0122.808] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.808] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0122.808] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.808] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0122.809] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.809] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.810] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfd [0122.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.810] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.818] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.860] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xfd, lpOverlapped=0x0) returned 1 [0122.861] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0122.861] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.876] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.880] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.886] CloseHandle (hObject=0x1a8) returned 1 [0122.886] CloseHandle (hObject=0x1b0) returned 1 [0122.886] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.887] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.887] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0122.887] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.887] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0122.887] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 1 [0122.888] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0122.888] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.888] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0122.888] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.888] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0122.888] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.888] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.889] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.889] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.889] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee [0122.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0122.889] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0122.897] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0122.938] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xee, lpOverlapped=0x0) returned 1 [0122.939] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0122.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0122.954] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0122.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.964] CloseHandle (hObject=0x1b0) returned 1 [0122.964] CloseHandle (hObject=0x1a8) returned 1 [0122.965] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0122.965] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0122.965] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0122.965] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0122.965] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0122.965] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 1 [0122.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0122.966] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0122.966] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0122.966] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0122.966] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0122.967] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.967] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0122.967] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0122.967] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0122.967] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0122.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.063] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.070] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.112] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe8, lpOverlapped=0x0) returned 1 [0123.113] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0123.114] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.128] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.138] CloseHandle (hObject=0x1a8) returned 1 [0123.139] CloseHandle (hObject=0x1b0) returned 1 [0123.139] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.139] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.139] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0123.140] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.140] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0123.140] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 1 [0123.141] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0123.141] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.141] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0123.141] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.141] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0123.141] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.141] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.141] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.141] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.142] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0123.142] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.142] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.149] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.190] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0123.204] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0123.209] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.223] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.227] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.234] CloseHandle (hObject=0x1b0) returned 1 [0123.234] CloseHandle (hObject=0x1a8) returned 1 [0123.234] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.235] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.235] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0123.235] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.235] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0123.235] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 1 [0123.236] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 0xffffffff [0123.236] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.236] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0123.236] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.236] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0123.236] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.236] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.237] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.237] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.238] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0123.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.238] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.246] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.288] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x108, lpOverlapped=0x0) returned 1 [0123.290] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0123.290] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.306] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.309] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.316] CloseHandle (hObject=0x1a8) returned 1 [0123.316] CloseHandle (hObject=0x1b0) returned 1 [0123.316] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.317] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.317] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0123.317] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.317] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0123.317] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 1 [0123.318] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0123.318] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.318] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0123.318] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.318] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0123.318] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.318] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.319] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.321] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.321] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0123.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.321] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.329] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.370] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0123.372] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0123.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.387] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.391] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.397] CloseHandle (hObject=0x1b0) returned 1 [0123.398] CloseHandle (hObject=0x1a8) returned 1 [0123.398] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.398] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.398] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0123.398] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.398] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0123.399] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0123.399] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0123.399] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.399] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0123.400] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.400] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0123.400] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.400] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.400] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.400] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.401] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0123.401] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.401] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.408] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.449] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xdf, lpOverlapped=0x0) returned 1 [0123.450] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0123.451] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.466] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.469] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.476] CloseHandle (hObject=0x1a8) returned 1 [0123.476] CloseHandle (hObject=0x1b0) returned 1 [0123.476] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.476] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.476] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0123.477] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.477] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0123.477] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0123.477] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0123.477] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.478] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0123.478] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0123.478] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.478] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.478] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.478] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.479] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x109 [0123.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.479] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.487] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.530] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x109, lpOverlapped=0x0) returned 1 [0123.534] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0123.535] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.556] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.570] CloseHandle (hObject=0x1b0) returned 1 [0123.570] CloseHandle (hObject=0x1a8) returned 1 [0123.570] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.571] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.571] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0123.571] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.571] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0123.571] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 1 [0123.572] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0123.572] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.572] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0123.572] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.572] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0123.572] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.572] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.573] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.573] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.573] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11e [0123.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.574] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.581] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.627] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x11e, lpOverlapped=0x0) returned 1 [0123.628] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x120, lpOverlapped=0x0) returned 1 [0123.629] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.650] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.654] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.661] CloseHandle (hObject=0x1a8) returned 1 [0123.661] CloseHandle (hObject=0x1b0) returned 1 [0123.661] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0123.662] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.662] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0123.662] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 1 [0123.663] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0123.663] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.663] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0123.663] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.663] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0123.663] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.663] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.664] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.664] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.664] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd2 [0123.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.665] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.673] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.783] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xd2, lpOverlapped=0x0) returned 1 [0123.784] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0123.785] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.802] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.806] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.812] CloseHandle (hObject=0x1b0) returned 1 [0123.812] CloseHandle (hObject=0x1a8) returned 1 [0123.813] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.813] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.814] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0123.814] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.814] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0123.814] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 1 [0123.815] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0xffffffff [0123.815] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.815] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0123.815] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.815] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0123.815] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.815] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.815] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.815] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.816] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde [0123.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.816] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.823] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.866] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xde, lpOverlapped=0x0) returned 1 [0123.867] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xe0, lpOverlapped=0x0) returned 1 [0123.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.882] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.886] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.893] CloseHandle (hObject=0x1a8) returned 1 [0123.893] CloseHandle (hObject=0x1b0) returned 1 [0123.893] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0123.893] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0123.893] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0123.894] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0123.894] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0123.894] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 1 [0123.894] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0123.894] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0123.894] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0123.895] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0123.895] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0123.895] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.895] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0123.895] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0123.895] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0123.896] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0123.896] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0123.896] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0123.902] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0123.945] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xea, lpOverlapped=0x0) returned 1 [0123.946] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0123.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0123.962] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0123.965] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.070] CloseHandle (hObject=0x1b0) returned 1 [0124.070] CloseHandle (hObject=0x1a8) returned 1 [0124.070] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.071] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.071] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0124.071] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.071] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0124.071] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 1 [0124.072] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0124.072] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.072] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0124.072] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.072] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0124.072] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.072] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.073] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.073] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.073] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127 [0124.073] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.074] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.081] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.123] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x127, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x127, lpOverlapped=0x0) returned 1 [0124.125] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0124.126] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.142] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.147] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.154] CloseHandle (hObject=0x1a8) returned 1 [0124.154] CloseHandle (hObject=0x1b0) returned 1 [0124.154] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.155] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.155] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534ec0 [0124.155] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.155] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0124.155] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 1 [0124.156] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0124.156] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.156] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0124.156] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0124.156] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.156] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.157] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.157] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.173] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144 [0124.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.174] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.180] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.223] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x144, lpOverlapped=0x0) returned 1 [0124.224] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x150, lpOverlapped=0x0) returned 1 [0124.225] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.240] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.244] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.251] CloseHandle (hObject=0x1b0) returned 1 [0124.251] CloseHandle (hObject=0x1a8) returned 1 [0124.251] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.252] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.252] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0124.252] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.252] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0124.252] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 1 [0124.253] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0xffffffff [0124.253] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.253] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0124.253] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.253] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0124.253] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.253] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.254] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.254] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.254] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0124.254] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.255] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.262] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.306] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xea, lpOverlapped=0x0) returned 1 [0124.310] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0124.310] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.325] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.329] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.336] CloseHandle (hObject=0x1a8) returned 1 [0124.336] CloseHandle (hObject=0x1b0) returned 1 [0124.336] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.337] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.337] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0124.337] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.337] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0124.337] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 1 [0124.338] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0124.338] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.338] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0124.338] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.338] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0124.338] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.338] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.338] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.339] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.339] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130 [0124.339] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.340] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.349] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.393] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x130, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x130, lpOverlapped=0x0) returned 1 [0124.393] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x140, lpOverlapped=0x0) returned 1 [0124.394] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.409] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.413] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.420] CloseHandle (hObject=0x1b0) returned 1 [0124.420] CloseHandle (hObject=0x1a8) returned 1 [0124.420] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.421] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.421] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0124.421] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.421] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0124.421] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 1 [0124.422] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0124.422] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.422] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0124.422] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.422] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0124.422] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.422] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.423] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.423] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.423] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0124.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.424] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.431] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.473] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xe8, lpOverlapped=0x0) returned 1 [0124.475] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0xf0, lpOverlapped=0x0) returned 1 [0124.476] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.491] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.501] CloseHandle (hObject=0x1a8) returned 1 [0124.501] CloseHandle (hObject=0x1b0) returned 1 [0124.501] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.502] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0124.502] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.502] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0124.503] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 1 [0124.503] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0124.503] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.503] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0124.503] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.504] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0124.504] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.504] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.504] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.504] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.505] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0124.505] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.505] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.511] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.553] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x102, lpOverlapped=0x0) returned 1 [0124.564] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x110, lpOverlapped=0x0) returned 1 [0124.577] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.592] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.596] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.602] CloseHandle (hObject=0x1b0) returned 1 [0124.602] CloseHandle (hObject=0x1a8) returned 1 [0124.603] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.603] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.603] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0124.603] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.603] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0124.603] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0124.604] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 0xffffffff [0124.604] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.604] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0124.604] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.604] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0124.605] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.605] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0124.605] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0124.605] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.605] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf9 [0124.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.606] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.613] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.660] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0xf9, lpOverlapped=0x0) returned 1 [0124.661] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x100, lpOverlapped=0x0) returned 1 [0124.661] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.676] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.680] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.687] CloseHandle (hObject=0x1a8) returned 1 [0124.687] CloseHandle (hObject=0x1b0) returned 1 [0124.687] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.688] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.688] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0124.688] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0124.688] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0124.688] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0124.689] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0124.689] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0124.689] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0124.689] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0124.689] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0124.689] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0124.689] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x5353c0 [0124.690] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.690] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0124.691] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0124.691] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.693] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2686 [0124.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.693] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.700] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.747] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2686, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x2686, lpOverlapped=0x0) returned 1 [0124.748] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x2690, lpOverlapped=0x0) returned 1 [0124.749] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0124.764] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0124.768] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.774] CloseHandle (hObject=0x1ac) returned 1 [0124.774] CloseHandle (hObject=0x1b0) returned 1 [0124.774] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0124.775] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0124.775] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0124.775] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0124.775] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0124.775] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 1 [0124.776] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0124.776] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0124.776] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0124.776] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0124.776] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0124.776] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0124.776] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0124.776] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0124.776] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534ec0 [0124.778] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0124.778] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0124.778] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x5351c0 [0124.779] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0124.780] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0124.780] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0124.781] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0124.781] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c0bf [0124.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0124.781] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0124.788] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0124.834] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x8c0bf, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x8c0bf, lpOverlapped=0x0) returned 1 [0125.071] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x8c0c0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x8c0c0, lpOverlapped=0x0) returned 1 [0125.078] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0125.093] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0125.100] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.107] CloseHandle (hObject=0x1a4) returned 1 [0125.107] CloseHandle (hObject=0x1b0) returned 1 [0125.107] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0125.108] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0125.108] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5353c0 [0125.108] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0125.108] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0125.108] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1 [0125.113] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 0xffffffff [0125.113] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0125.113] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0125.113] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0125.114] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa89c [0125.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0125.114] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0125.121] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0125.167] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xa89c, lpOverlapped=0x0) returned 1 [0125.396] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xa8a0, lpOverlapped=0x0) returned 1 [0125.397] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0125.412] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0125.416] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.424] CloseHandle (hObject=0x1b0) returned 1 [0125.424] CloseHandle (hObject=0x1a4) returned 1 [0125.427] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0125.427] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0125.428] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0125.428] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0125.428] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0125.428] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1 [0125.429] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 0xffffffff [0125.429] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0125.429] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0125.429] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0125.430] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x181aa [0125.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0125.430] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0125.438] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0125.483] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x181aa, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x181aa, lpOverlapped=0x0) returned 1 [0125.527] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x181b0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x181b0, lpOverlapped=0x0) returned 1 [0125.529] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0125.547] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0125.552] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.560] CloseHandle (hObject=0x1a4) returned 1 [0125.560] CloseHandle (hObject=0x1b0) returned 1 [0125.560] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0125.561] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0125.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0125.561] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0125.561] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0125.562] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1 [0125.564] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 0xffffffff [0125.564] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0125.565] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0125.566] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0125.567] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x111e1 [0125.567] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0125.567] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0125.574] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0125.619] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x111e1, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x111e1, lpOverlapped=0x0) returned 1 [0125.640] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x111f0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x111f0, lpOverlapped=0x0) returned 1 [0125.641] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0125.662] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0125.666] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.672] CloseHandle (hObject=0x1b0) returned 1 [0125.672] CloseHandle (hObject=0x1a4) returned 1 [0125.672] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0125.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0125.674] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534d00 [0125.674] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0125.674] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0125.674] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1 [0125.675] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 0xffffffff [0125.675] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0125.676] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0125.676] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0125.676] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a258 [0125.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0125.677] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0125.683] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0125.730] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3a258, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x3a258, lpOverlapped=0x0) returned 1 [0125.784] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3a260, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x3a260, lpOverlapped=0x0) returned 1 [0125.787] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0125.802] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0125.805] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.812] CloseHandle (hObject=0x1a4) returned 1 [0125.812] CloseHandle (hObject=0x1b0) returned 1 [0125.812] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0125.813] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0125.815] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534e40 [0125.815] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0125.815] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0125.815] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1 [0125.817] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 0xffffffff [0125.817] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0125.818] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0125.818] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0125.818] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce17 [0125.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0125.819] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0125.825] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0125.872] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce17, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xce17, lpOverlapped=0x0) returned 1 [0126.052] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xce20, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xce20, lpOverlapped=0x0) returned 1 [0126.054] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.070] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.075] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.082] CloseHandle (hObject=0x1b0) returned 1 [0126.082] CloseHandle (hObject=0x1a4) returned 1 [0126.082] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.083] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.083] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0126.083] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0126.083] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0126.083] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1 [0126.084] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 0xffffffff [0126.084] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0126.084] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535080 [0126.126] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.126] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.126] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.128] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.128] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a1d [0126.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.129] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.135] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.182] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x1a1d, lpOverlapped=0x0) returned 1 [0126.193] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x1a20, lpOverlapped=0x0) returned 1 [0126.194] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.209] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.219] CloseHandle (hObject=0x1b0) returned 1 [0126.219] CloseHandle (hObject=0x1ac) returned 1 [0126.219] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.221] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.222] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x5353c0 [0126.222] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.222] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0126.222] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1 [0126.223] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 0xffffffff [0126.223] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.223] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.223] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.223] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x221da [0126.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.224] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.231] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.277] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x221da, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x221da, lpOverlapped=0x0) returned 1 [0126.294] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x221e0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x221e0, lpOverlapped=0x0) returned 1 [0126.296] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.312] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.315] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.322] CloseHandle (hObject=0x1ac) returned 1 [0126.322] CloseHandle (hObject=0x1b0) returned 1 [0126.322] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.323] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.323] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0126.323] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.323] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0126.323] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1 [0126.325] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 0xffffffff [0126.325] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.325] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.325] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.326] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf2 [0126.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.326] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.334] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.378] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xf2, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0xf2, lpOverlapped=0x0) returned 1 [0126.379] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x100, lpOverlapped=0x0) returned 1 [0126.379] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.396] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.407] CloseHandle (hObject=0x1b0) returned 1 [0126.407] CloseHandle (hObject=0x1ac) returned 1 [0126.407] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534e40 [0126.408] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.408] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0126.408] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1 [0126.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 0xffffffff [0126.410] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.411] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bef [0126.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.411] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.418] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.460] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1bef, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x1bef, lpOverlapped=0x0) returned 1 [0126.473] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x1bf0, lpOverlapped=0x0) returned 1 [0126.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.500] CloseHandle (hObject=0x1ac) returned 1 [0126.500] CloseHandle (hObject=0x1b0) returned 1 [0126.500] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.501] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534e80 [0126.501] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.501] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0126.501] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0126.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0xffffffff [0126.502] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.503] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.504] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0126.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.504] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.511] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.555] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x3b, lpOverlapped=0x0) returned 1 [0126.561] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x40, lpOverlapped=0x0) returned 1 [0126.562] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.580] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.585] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.594] CloseHandle (hObject=0x1b0) returned 1 [0126.594] CloseHandle (hObject=0x1ac) returned 1 [0126.594] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.596] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.596] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x5353c0 [0126.596] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.596] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0126.597] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1 [0126.598] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 0xffffffff [0126.598] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.598] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.598] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.599] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x828 [0126.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.599] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.608] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.668] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x828, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x828, lpOverlapped=0x0) returned 1 [0126.681] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x830, lpOverlapped=0x0) returned 1 [0126.681] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.697] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.701] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.713] CloseHandle (hObject=0x1ac) returned 1 [0126.713] CloseHandle (hObject=0x1b0) returned 1 [0126.713] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.714] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.715] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535040 [0126.715] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.715] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0126.715] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1 [0126.716] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 0xffffffff [0126.716] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.716] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.717] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.718] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0126.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.718] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.727] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.778] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x3b, lpOverlapped=0x0) returned 1 [0126.779] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x40, lpOverlapped=0x0) returned 1 [0126.780] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.800] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.805] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.815] CloseHandle (hObject=0x1b0) returned 1 [0126.816] CloseHandle (hObject=0x1ac) returned 1 [0126.816] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.817] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.817] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535300 [0126.817] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.817] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0126.817] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1 [0126.818] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 0xffffffff [0126.818] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.819] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.819] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.820] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b [0126.820] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.820] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.830] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.884] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x3b, lpOverlapped=0x0) returned 1 [0126.891] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x40, lpOverlapped=0x0) returned 1 [0126.892] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0126.908] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0126.912] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.918] CloseHandle (hObject=0x1ac) returned 1 [0126.919] CloseHandle (hObject=0x1b0) returned 1 [0126.919] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0126.919] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0126.920] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0126.920] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0126.920] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0126.920] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1 [0126.921] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 0xffffffff [0126.921] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0126.921] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0126.921] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0126.921] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534e40 [0126.923] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.923] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0126.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0126.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0126.940] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x174c [0126.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0126.940] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0126.947] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0126.990] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x174c, lpOverlapped=0x0) returned 1 [0126.991] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x1750, lpOverlapped=0x0) returned 1 [0126.992] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.097] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.100] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.107] CloseHandle (hObject=0x1b0) returned 1 [0127.107] CloseHandle (hObject=0x1ac) returned 1 [0127.107] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.108] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.108] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534e80 [0127.108] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0127.108] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0127.108] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1 [0127.109] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 0xffffffff [0127.109] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0127.109] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0127.109] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.110] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x945 [0127.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.110] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.117] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.162] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x945, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x945, lpOverlapped=0x0) returned 1 [0127.163] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x950, lpOverlapped=0x0) returned 1 [0127.164] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.180] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.183] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.191] CloseHandle (hObject=0x1ac) returned 1 [0127.191] CloseHandle (hObject=0x1b0) returned 1 [0127.191] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.192] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.192] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0127.192] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0127.192] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0127.192] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1 [0127.193] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 0xffffffff [0127.193] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0127.193] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0127.193] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.194] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.194] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.194] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc878 [0127.195] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.195] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.202] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.245] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc878, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xc878, lpOverlapped=0x0) returned 1 [0127.293] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xc880, lpOverlapped=0x0) returned 1 [0127.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.339] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.342] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.350] CloseHandle (hObject=0x1a4) returned 1 [0127.350] CloseHandle (hObject=0x1b0) returned 1 [0127.350] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.351] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.351] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0127.351] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.351] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0127.351] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1 [0127.352] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 0xffffffff [0127.352] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.352] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.356] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.356] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc26 [0127.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.357] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.364] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.409] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc26, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0xc26, lpOverlapped=0x0) returned 1 [0127.410] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0xc30, lpOverlapped=0x0) returned 1 [0127.411] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.428] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.438] CloseHandle (hObject=0x1b0) returned 1 [0127.439] CloseHandle (hObject=0x1a4) returned 1 [0127.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.440] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535040 [0127.440] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.440] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0127.440] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1 [0127.441] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 0xffffffff [0127.441] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.442] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38a8 [0127.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.442] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.449] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.505] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x38a8, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x38a8, lpOverlapped=0x0) returned 1 [0127.515] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x38b0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x38b0, lpOverlapped=0x0) returned 1 [0127.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.531] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.536] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.542] CloseHandle (hObject=0x1a4) returned 1 [0127.542] CloseHandle (hObject=0x1b0) returned 1 [0127.542] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.543] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.543] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x5353c0 [0127.543] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.543] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0127.543] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 1 [0127.544] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 0xffffffff [0127.544] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.545] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b20 [0127.545] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.546] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.552] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.598] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b20, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x2b20, lpOverlapped=0x0) returned 1 [0127.632] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x2b30, lpOverlapped=0x0) returned 1 [0127.633] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.648] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.652] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.665] CloseHandle (hObject=0x1b0) returned 1 [0127.665] CloseHandle (hObject=0x1a4) returned 1 [0127.665] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.666] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.666] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534f00 [0127.666] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.666] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0127.666] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 1 [0127.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 0xffffffff [0127.667] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.667] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.668] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.668] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f8 [0127.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.668] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.676] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.723] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x8f8, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x8f8, lpOverlapped=0x0) returned 1 [0127.730] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x900, lpOverlapped=0x0) returned 1 [0127.731] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.746] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.749] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.757] CloseHandle (hObject=0x1a4) returned 1 [0127.757] CloseHandle (hObject=0x1b0) returned 1 [0127.757] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.758] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.758] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535300 [0127.758] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.758] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0127.758] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 1 [0127.759] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 0xffffffff [0127.759] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.759] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.759] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.760] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46039 [0127.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.760] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.767] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.809] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x46039, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x46039, lpOverlapped=0x0) returned 1 [0127.827] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x46040, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x46040, lpOverlapped=0x0) returned 1 [0127.831] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.848] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.852] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.858] CloseHandle (hObject=0x1b0) returned 1 [0127.858] CloseHandle (hObject=0x1a4) returned 1 [0127.858] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.859] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.859] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0127.859] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.859] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0127.859] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 1 [0127.863] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 0xffffffff [0127.863] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.863] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.864] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.864] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7c33 [0127.864] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.865] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.871] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0127.914] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x7c33, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x7c33, lpOverlapped=0x0) returned 1 [0127.932] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x7c40, lpOverlapped=0x0) returned 1 [0127.933] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0127.948] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0127.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.959] CloseHandle (hObject=0x1a4) returned 1 [0127.959] CloseHandle (hObject=0x1b0) returned 1 [0127.959] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0127.959] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0127.960] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534e80 [0127.960] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0127.960] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0127.960] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 1 [0127.961] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 0xffffffff [0127.961] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0127.961] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0127.961] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0127.962] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2adeb [0127.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0127.962] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0127.976] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.127] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2adeb, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x2adeb, lpOverlapped=0x0) returned 1 [0128.147] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2adf0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x2adf0, lpOverlapped=0x0) returned 1 [0128.149] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.165] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.168] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.176] CloseHandle (hObject=0x1b0) returned 1 [0128.176] CloseHandle (hObject=0x1a4) returned 1 [0128.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.177] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535200 [0128.177] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0128.177] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0128.177] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 1 [0128.179] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 0xffffffff [0128.179] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0128.179] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0128.179] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0128.180] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x794cf [0128.180] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.180] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.187] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.230] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x794cf, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x794cf, lpOverlapped=0x0) returned 1 [0128.258] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x794d0, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x794d0, lpOverlapped=0x0) returned 1 [0128.264] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.279] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.283] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.290] CloseHandle (hObject=0x1a4) returned 1 [0128.290] CloseHandle (hObject=0x1b0) returned 1 [0128.290] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.291] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.291] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534cc0 [0128.291] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0128.291] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0128.291] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 1 [0128.295] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 0xffffffff [0128.295] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0128.295] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0128.295] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0128.296] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x941 [0128.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.296] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.304] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.353] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x941, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x941, lpOverlapped=0x0) returned 1 [0128.363] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x950, lpOverlapped=0x0) returned 1 [0128.364] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.380] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.383] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.391] CloseHandle (hObject=0x1b0) returned 1 [0128.391] CloseHandle (hObject=0x1a4) returned 1 [0128.391] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.393] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.393] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x535200 [0128.393] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0128.393] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0128.393] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 1 [0128.394] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 0xffffffff [0128.394] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0128.394] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534f00 [0128.397] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.398] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.398] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0128.398] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.398] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.399] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.399] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.400] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4827 [0128.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.400] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.407] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.449] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4827, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x4827, lpOverlapped=0x0) returned 1 [0128.458] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4830, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4830, lpOverlapped=0x0) returned 1 [0128.459] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.474] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.478] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.485] CloseHandle (hObject=0x1ac) returned 1 [0128.485] CloseHandle (hObject=0x1a8) returned 1 [0128.485] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.486] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.486] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0128.487] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0128.487] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0128.487] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 1 [0128.488] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 0xffffffff [0128.488] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0128.488] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0128.488] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.488] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0128.488] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.488] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.488] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.490] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.490] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45bf [0128.490] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.491] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.500] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.545] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x45bf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x45bf, lpOverlapped=0x0) returned 1 [0128.547] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x45c0, lpOverlapped=0x0) returned 1 [0128.547] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.562] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.566] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.573] CloseHandle (hObject=0x1a8) returned 1 [0128.573] CloseHandle (hObject=0x1ac) returned 1 [0128.573] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.574] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.574] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0128.574] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0128.574] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0128.574] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 1 [0128.575] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 0xffffffff [0128.575] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0128.575] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0128.575] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.575] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0128.575] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.575] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.576] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.576] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.576] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b63 [0128.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.576] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.585] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.631] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4b63, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x4b63, lpOverlapped=0x0) returned 1 [0128.637] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4b70, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4b70, lpOverlapped=0x0) returned 1 [0128.638] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.654] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.665] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.671] CloseHandle (hObject=0x1ac) returned 1 [0128.672] CloseHandle (hObject=0x1a8) returned 1 [0128.672] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.672] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.675] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0128.675] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0128.675] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0128.675] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 1 [0128.684] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 0xffffffff [0128.684] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0128.684] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0128.684] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.684] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535240 [0128.684] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.684] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.684] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.703] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.704] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52cb [0128.704] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.704] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.718] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.769] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x52cb, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x52cb, lpOverlapped=0x0) returned 1 [0128.777] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x52d0, lpOverlapped=0x0) returned 1 [0128.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.794] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.805] CloseHandle (hObject=0x1a8) returned 1 [0128.805] CloseHandle (hObject=0x1ac) returned 1 [0128.805] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.806] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.806] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0128.806] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0128.806] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0128.806] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 1 [0128.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 0xffffffff [0128.807] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0128.807] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0128.807] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0128.807] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.807] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.808] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.808] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.808] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x405d [0128.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.809] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.815] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.860] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x405d, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x405d, lpOverlapped=0x0) returned 1 [0128.866] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4060, lpOverlapped=0x0) returned 1 [0128.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.883] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.888] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.895] CloseHandle (hObject=0x1ac) returned 1 [0128.895] CloseHandle (hObject=0x1a8) returned 1 [0128.895] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.896] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.896] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0128.896] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0128.896] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0128.896] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 1 [0128.897] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 0xffffffff [0128.897] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0128.897] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0128.897] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.897] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0128.897] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.897] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.897] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.900] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.901] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4029 [0128.901] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.901] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.908] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0128.950] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4029, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x4029, lpOverlapped=0x0) returned 1 [0128.954] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4030, lpOverlapped=0x0) returned 1 [0128.955] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0128.970] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0128.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.984] CloseHandle (hObject=0x1a8) returned 1 [0128.984] CloseHandle (hObject=0x1ac) returned 1 [0128.985] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0128.985] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0128.985] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0128.985] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0128.986] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0128.986] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 1 [0128.986] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 0xffffffff [0128.987] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0128.987] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0128.987] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0128.987] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0128.987] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.987] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0128.987] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0128.987] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0128.988] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f79 [0128.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0128.988] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0128.995] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.124] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3f79, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3f79, lpOverlapped=0x0) returned 1 [0129.135] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3f80, lpOverlapped=0x0) returned 1 [0129.136] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.152] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.155] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.162] CloseHandle (hObject=0x1ac) returned 1 [0129.162] CloseHandle (hObject=0x1a8) returned 1 [0129.163] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.164] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.164] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0129.164] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.165] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0129.165] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 1 [0129.166] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 0xffffffff [0129.166] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.166] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0129.166] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.166] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0129.166] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.167] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.167] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.168] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.169] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x406f [0129.169] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.169] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.176] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.219] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x406f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x406f, lpOverlapped=0x0) returned 1 [0129.231] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4070, lpOverlapped=0x0) returned 1 [0129.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.253] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.256] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.267] CloseHandle (hObject=0x1a8) returned 1 [0129.267] CloseHandle (hObject=0x1ac) returned 1 [0129.267] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.268] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.268] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0129.268] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.268] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0129.268] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 1 [0129.269] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 0xffffffff [0129.269] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.270] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0129.270] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.270] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0129.270] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.270] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.270] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.270] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.271] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4afe [0129.271] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.271] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.281] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.332] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4afe, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x4afe, lpOverlapped=0x0) returned 1 [0129.346] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4b00, lpOverlapped=0x0) returned 1 [0129.347] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.362] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.367] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.374] CloseHandle (hObject=0x1ac) returned 1 [0129.374] CloseHandle (hObject=0x1a8) returned 1 [0129.374] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.375] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.375] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0129.375] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.375] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0129.375] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 1 [0129.376] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 0xffffffff [0129.376] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.376] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0129.376] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.376] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0129.376] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.376] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.376] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.381] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.382] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d7a [0129.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.382] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.390] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.435] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3d7a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3d7a, lpOverlapped=0x0) returned 1 [0129.437] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3d80, lpOverlapped=0x0) returned 1 [0129.438] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.453] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.456] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.463] CloseHandle (hObject=0x1a8) returned 1 [0129.463] CloseHandle (hObject=0x1ac) returned 1 [0129.472] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.472] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.472] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0129.473] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.473] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0129.473] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 1 [0129.473] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 0xffffffff [0129.474] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.474] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0129.479] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.479] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0129.480] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.480] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.480] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404b [0129.481] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.481] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.487] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.532] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x404b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x404b, lpOverlapped=0x0) returned 1 [0129.534] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4050, lpOverlapped=0x0) returned 1 [0129.535] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.550] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.560] CloseHandle (hObject=0x1ac) returned 1 [0129.560] CloseHandle (hObject=0x1a8) returned 1 [0129.560] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.561] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0129.561] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.561] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0129.561] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 1 [0129.562] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 0xffffffff [0129.562] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.562] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0129.562] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.562] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0129.562] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.562] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.562] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.563] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.564] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e85 [0129.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.564] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.570] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.612] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3e85, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3e85, lpOverlapped=0x0) returned 1 [0129.614] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3e90, lpOverlapped=0x0) returned 1 [0129.614] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.629] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.633] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.640] CloseHandle (hObject=0x1a8) returned 1 [0129.640] CloseHandle (hObject=0x1ac) returned 1 [0129.640] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.640] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.640] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0129.641] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.641] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0129.641] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 1 [0129.642] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 0xffffffff [0129.642] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.642] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0129.642] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.642] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0129.642] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.642] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.642] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.642] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.643] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46f5 [0129.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.643] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.651] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.697] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x46f5, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x46f5, lpOverlapped=0x0) returned 1 [0129.698] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4700, lpOverlapped=0x0) returned 1 [0129.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.715] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.718] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.725] CloseHandle (hObject=0x1ac) returned 1 [0129.725] CloseHandle (hObject=0x1a8) returned 1 [0129.725] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.726] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.726] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0129.726] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.726] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0129.726] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 1 [0129.727] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 0xffffffff [0129.727] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.727] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0129.727] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.727] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0129.727] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.727] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.728] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.728] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.729] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f4c [0129.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.729] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.735] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.777] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3f4c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3f4c, lpOverlapped=0x0) returned 1 [0129.781] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3f50, lpOverlapped=0x0) returned 1 [0129.782] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.796] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.800] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.807] CloseHandle (hObject=0x1a8) returned 1 [0129.807] CloseHandle (hObject=0x1ac) returned 1 [0129.807] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.808] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.808] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0129.808] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.808] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0129.808] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 1 [0129.809] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 0xffffffff [0129.809] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.809] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0129.809] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.809] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0129.809] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.809] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.810] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.810] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.810] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4082 [0129.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.810] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.858] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4082, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x4082, lpOverlapped=0x0) returned 1 [0129.870] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4090, lpOverlapped=0x0) returned 1 [0129.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.886] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.889] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.896] CloseHandle (hObject=0x1ac) returned 1 [0129.896] CloseHandle (hObject=0x1a8) returned 1 [0129.896] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.896] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.897] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0129.897] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.897] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0129.897] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 1 [0129.898] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 0xffffffff [0129.898] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.898] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0129.898] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.898] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0129.898] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.898] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.898] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.899] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.900] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x419f [0129.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.900] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.907] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0129.948] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x419f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x419f, lpOverlapped=0x0) returned 1 [0129.956] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x41a0, lpOverlapped=0x0) returned 1 [0129.957] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0129.972] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0129.975] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.982] CloseHandle (hObject=0x1a8) returned 1 [0129.982] CloseHandle (hObject=0x1ac) returned 1 [0129.982] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0129.983] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0129.983] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0129.983] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0129.983] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0129.983] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 1 [0129.984] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 0xffffffff [0129.984] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0129.984] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0129.984] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0129.984] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0129.984] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.984] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0129.985] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0129.985] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0129.985] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5079 [0129.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0129.985] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0129.992] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.159] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5079, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x5079, lpOverlapped=0x0) returned 1 [0130.173] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x5080, lpOverlapped=0x0) returned 1 [0130.174] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.193] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.219] CloseHandle (hObject=0x1ac) returned 1 [0130.219] CloseHandle (hObject=0x1a8) returned 1 [0130.219] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.220] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.220] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0130.220] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.220] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0130.220] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 1 [0130.221] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 0xffffffff [0130.221] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.221] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0130.221] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.221] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0130.223] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.223] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.223] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.224] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.224] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50f7 [0130.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.226] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.234] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.277] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x50f7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x50f7, lpOverlapped=0x0) returned 1 [0130.288] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x5100, lpOverlapped=0x0) returned 1 [0130.289] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.308] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.312] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.319] CloseHandle (hObject=0x1a8) returned 1 [0130.319] CloseHandle (hObject=0x1ac) returned 1 [0130.321] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.322] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.322] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0130.322] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.322] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0130.322] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 1 [0130.323] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 0xffffffff [0130.323] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.323] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0130.323] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.323] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0130.323] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.323] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.323] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.324] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.324] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ff2 [0130.324] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.324] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.331] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.379] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3ff2, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3ff2, lpOverlapped=0x0) returned 1 [0130.380] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4000, lpOverlapped=0x0) returned 1 [0130.381] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.397] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.401] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.407] CloseHandle (hObject=0x1ac) returned 1 [0130.407] CloseHandle (hObject=0x1a8) returned 1 [0130.408] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0130.408] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.408] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0130.408] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 1 [0130.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 0xffffffff [0130.409] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.409] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0130.409] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.409] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0130.410] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.410] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.410] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.413] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.413] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40d4 [0130.413] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.413] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.420] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.463] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x40d4, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x40d4, lpOverlapped=0x0) returned 1 [0130.475] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x40e0, lpOverlapped=0x0) returned 1 [0130.475] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.495] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.502] CloseHandle (hObject=0x1a8) returned 1 [0130.502] CloseHandle (hObject=0x1ac) returned 1 [0130.502] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.503] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.503] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0130.503] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.503] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0130.503] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 1 [0130.504] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 0xffffffff [0130.504] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.504] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0130.504] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.504] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0130.505] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.505] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.505] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.505] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.506] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e5d [0130.506] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.506] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.513] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.558] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3e5d, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3e5d, lpOverlapped=0x0) returned 1 [0130.570] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3e60, lpOverlapped=0x0) returned 1 [0130.571] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.587] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.590] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.597] CloseHandle (hObject=0x1ac) returned 1 [0130.597] CloseHandle (hObject=0x1a8) returned 1 [0130.597] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.598] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.598] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0130.598] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.598] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0130.598] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 1 [0130.599] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 0xffffffff [0130.599] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.599] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0130.600] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.600] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0130.600] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.600] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.600] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.602] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.603] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f0c [0130.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.604] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.611] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.656] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3f0c, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3f0c, lpOverlapped=0x0) returned 1 [0130.669] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3f10, lpOverlapped=0x0) returned 1 [0130.670] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.686] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.689] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.696] CloseHandle (hObject=0x1a8) returned 1 [0130.696] CloseHandle (hObject=0x1ac) returned 1 [0130.696] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.697] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.697] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0130.697] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.697] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0130.697] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 1 [0130.698] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 0xffffffff [0130.698] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.698] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0130.698] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.698] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0130.699] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.699] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.699] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.699] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.699] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5074 [0130.699] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.700] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.706] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.748] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5074, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x5074, lpOverlapped=0x0) returned 1 [0130.750] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x5080, lpOverlapped=0x0) returned 1 [0130.751] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.766] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.769] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.776] CloseHandle (hObject=0x1ac) returned 1 [0130.776] CloseHandle (hObject=0x1a8) returned 1 [0130.777] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.777] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.777] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0130.777] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.777] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0130.777] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 1 [0130.778] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 0xffffffff [0130.778] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.778] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0130.778] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.778] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0130.779] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.779] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.779] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.780] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.780] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x447a [0130.780] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.780] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.787] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.828] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x447a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x447a, lpOverlapped=0x0) returned 1 [0130.837] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4480, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4480, lpOverlapped=0x0) returned 1 [0130.837] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.853] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.857] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.863] CloseHandle (hObject=0x1a8) returned 1 [0130.863] CloseHandle (hObject=0x1ac) returned 1 [0130.863] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.864] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.864] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0130.864] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.864] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0130.864] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 1 [0130.865] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 0xffffffff [0130.865] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.865] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0130.865] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.865] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0130.866] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.866] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.866] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.866] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.867] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55a3 [0130.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.867] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.874] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0130.915] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x55a3, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x55a3, lpOverlapped=0x0) returned 1 [0130.927] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x55b0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x55b0, lpOverlapped=0x0) returned 1 [0130.928] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0130.942] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0130.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.953] CloseHandle (hObject=0x1ac) returned 1 [0130.953] CloseHandle (hObject=0x1a8) returned 1 [0130.953] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0130.953] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0130.954] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0130.954] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0130.954] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0130.954] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 1 [0130.955] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 0xffffffff [0130.955] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0130.955] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0130.955] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0130.955] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0130.955] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.955] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0130.955] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0130.956] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0130.956] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x403a [0130.957] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0130.957] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0130.964] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.005] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x403a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x403a, lpOverlapped=0x0) returned 1 [0131.095] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4040, lpOverlapped=0x0) returned 1 [0131.096] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.111] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.115] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.121] CloseHandle (hObject=0x1a8) returned 1 [0131.121] CloseHandle (hObject=0x1ac) returned 1 [0131.121] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.122] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.122] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0131.122] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.122] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0131.122] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 1 [0131.123] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 0xffffffff [0131.123] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.123] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0131.123] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.123] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0131.124] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.124] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.124] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.124] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.124] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x416b [0131.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.125] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.131] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.174] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x416b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x416b, lpOverlapped=0x0) returned 1 [0131.177] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4170, lpOverlapped=0x0) returned 1 [0131.178] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.193] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.203] CloseHandle (hObject=0x1ac) returned 1 [0131.203] CloseHandle (hObject=0x1a8) returned 1 [0131.203] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.204] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.204] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0131.204] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.204] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0131.204] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 1 [0131.205] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 0xffffffff [0131.205] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.205] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0131.205] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.205] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0131.205] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.205] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.206] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.207] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.207] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x41bf [0131.207] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.207] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.214] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.255] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x41bf, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x41bf, lpOverlapped=0x0) returned 1 [0131.265] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x41c0, lpOverlapped=0x0) returned 1 [0131.266] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.280] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.291] CloseHandle (hObject=0x1a8) returned 1 [0131.291] CloseHandle (hObject=0x1ac) returned 1 [0131.291] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.291] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.291] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534d00 [0131.292] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.292] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0131.292] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 1 [0131.293] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 0xffffffff [0131.293] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.293] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0131.293] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.293] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0131.293] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.293] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.293] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.293] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.294] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x583f [0131.294] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.294] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.301] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.373] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x583f, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x583f, lpOverlapped=0x0) returned 1 [0131.380] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5840, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x5840, lpOverlapped=0x0) returned 1 [0131.381] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.397] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.400] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.407] CloseHandle (hObject=0x1ac) returned 1 [0131.407] CloseHandle (hObject=0x1a8) returned 1 [0131.407] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.408] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.408] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0131.408] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.408] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0131.408] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 1 [0131.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 0xffffffff [0131.409] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.409] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0131.409] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.409] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0131.409] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.409] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.409] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.412] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.412] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5224 [0131.412] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.412] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.419] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.460] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5224, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x5224, lpOverlapped=0x0) returned 1 [0131.462] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x5230, lpOverlapped=0x0) returned 1 [0131.463] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.478] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.481] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.488] CloseHandle (hObject=0x1a8) returned 1 [0131.488] CloseHandle (hObject=0x1ac) returned 1 [0131.488] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.489] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.489] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0131.489] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.489] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0131.489] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 1 [0131.490] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 0xffffffff [0131.490] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.490] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0131.490] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.490] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534f40 [0131.490] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.490] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.490] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.490] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.491] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f8b [0131.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.491] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.499] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.542] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3f8b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3f8b, lpOverlapped=0x0) returned 1 [0131.544] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3f90, lpOverlapped=0x0) returned 1 [0131.559] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.577] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.581] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.590] CloseHandle (hObject=0x1ac) returned 1 [0131.590] CloseHandle (hObject=0x1a8) returned 1 [0131.590] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.591] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0131.591] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.591] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0131.591] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 1 [0131.592] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 0xffffffff [0131.592] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.592] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0131.592] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.592] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0131.592] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.592] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.592] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.593] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.594] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ebc [0131.594] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.594] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.601] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.644] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3ebc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3ebc, lpOverlapped=0x0) returned 1 [0131.645] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3ec0, lpOverlapped=0x0) returned 1 [0131.646] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.662] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.670] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.677] CloseHandle (hObject=0x1a8) returned 1 [0131.677] CloseHandle (hObject=0x1ac) returned 1 [0131.677] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.678] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.678] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535240 [0131.678] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.678] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0131.678] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 1 [0131.680] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 0xffffffff [0131.680] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.680] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0131.680] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.680] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534d00 [0131.680] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.680] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.680] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.680] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.681] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f45 [0131.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.681] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.688] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.742] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3f45, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3f45, lpOverlapped=0x0) returned 1 [0131.743] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3f50, lpOverlapped=0x0) returned 1 [0131.744] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.759] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.772] CloseHandle (hObject=0x1ac) returned 1 [0131.772] CloseHandle (hObject=0x1a8) returned 1 [0131.772] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.774] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.775] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0131.775] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.775] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0131.775] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 1 [0131.776] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 0xffffffff [0131.776] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.776] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0131.776] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.776] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0131.776] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.776] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.776] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.778] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.779] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fd7 [0131.779] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.779] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.786] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.829] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3fd7, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3fd7, lpOverlapped=0x0) returned 1 [0131.845] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3fe0, lpOverlapped=0x0) returned 1 [0131.846] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.861] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.865] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.873] CloseHandle (hObject=0x1a8) returned 1 [0131.873] CloseHandle (hObject=0x1ac) returned 1 [0131.873] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.874] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.874] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0131.874] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.874] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0131.874] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 1 [0131.875] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 0xffffffff [0131.875] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.875] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0131.875] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.875] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0131.875] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.875] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.875] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.876] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.877] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0131.877] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.877] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.884] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0131.928] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3fdc, lpOverlapped=0x0) returned 1 [0131.930] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3fe0, lpOverlapped=0x0) returned 1 [0131.930] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0131.945] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0131.949] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.955] CloseHandle (hObject=0x1ac) returned 1 [0131.955] CloseHandle (hObject=0x1a8) returned 1 [0131.955] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0131.956] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0131.956] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e80 [0131.956] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0131.956] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0131.956] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 1 [0131.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 0xffffffff [0131.957] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0131.957] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0131.957] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0131.957] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0131.958] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.958] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0131.958] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0131.958] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0131.962] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0131.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0131.962] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0131.969] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.105] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3fdc, lpOverlapped=0x0) returned 1 [0132.119] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3fe0, lpOverlapped=0x0) returned 1 [0132.120] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.135] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.145] CloseHandle (hObject=0x1a8) returned 1 [0132.145] CloseHandle (hObject=0x1ac) returned 1 [0132.145] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.146] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.146] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0132.146] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.146] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0132.146] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 1 [0132.147] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 0xffffffff [0132.147] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.147] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0132.147] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.147] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0132.147] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.147] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.147] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.147] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.149] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fdc [0132.149] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.149] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.155] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.196] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3fdc, lpOverlapped=0x0) returned 1 [0132.202] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3fe0, lpOverlapped=0x0) returned 1 [0132.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.218] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.221] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.228] CloseHandle (hObject=0x1ac) returned 1 [0132.228] CloseHandle (hObject=0x1a8) returned 1 [0132.228] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.229] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.229] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534f40 [0132.229] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.229] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0132.229] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 1 [0132.230] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 0xffffffff [0132.230] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.230] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0132.230] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.230] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0132.230] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.230] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.231] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.231] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.232] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40db [0132.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.232] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.238] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.279] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x40db, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x40db, lpOverlapped=0x0) returned 1 [0132.297] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x40e0, lpOverlapped=0x0) returned 1 [0132.298] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.313] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.316] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.323] CloseHandle (hObject=0x1a8) returned 1 [0132.323] CloseHandle (hObject=0x1ac) returned 1 [0132.323] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.324] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.324] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535200 [0132.324] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.324] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0132.324] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 1 [0132.325] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 0xffffffff [0132.325] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.325] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.325] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.325] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0132.325] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.325] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.326] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.326] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.326] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x490e [0132.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.326] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.333] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.374] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x490e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x490e, lpOverlapped=0x0) returned 1 [0132.412] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4910, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4910, lpOverlapped=0x0) returned 1 [0132.413] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.428] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.431] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.438] CloseHandle (hObject=0x1ac) returned 1 [0132.438] CloseHandle (hObject=0x1a8) returned 1 [0132.438] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.439] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.439] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534cc0 [0132.439] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.439] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0132.439] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 1 [0132.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 0xffffffff [0132.440] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.440] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0132.440] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.440] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0132.440] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.440] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.440] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.442] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40fd [0132.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.442] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.451] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.493] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x40fd, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x40fd, lpOverlapped=0x0) returned 1 [0132.500] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4100, lpOverlapped=0x0) returned 1 [0132.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.516] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.519] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.526] CloseHandle (hObject=0x1a8) returned 1 [0132.526] CloseHandle (hObject=0x1ac) returned 1 [0132.526] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.527] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.527] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0132.527] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.527] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0132.527] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 1 [0132.528] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 0xffffffff [0132.528] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.528] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.528] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.528] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5353c0 [0132.528] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.528] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.528] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.528] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.529] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x407a [0132.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.529] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.536] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.578] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x407a, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x407a, lpOverlapped=0x0) returned 1 [0132.582] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4080, lpOverlapped=0x0) returned 1 [0132.583] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.598] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.602] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.608] CloseHandle (hObject=0x1ac) returned 1 [0132.608] CloseHandle (hObject=0x1a8) returned 1 [0132.609] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.609] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.609] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0132.609] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.609] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.610] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 1 [0132.610] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 0xffffffff [0132.610] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.611] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0132.611] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.611] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535040 [0132.611] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.611] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.611] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.613] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.613] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x49c1 [0132.613] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.614] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.622] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.662] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x49c1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x49c1, lpOverlapped=0x0) returned 1 [0132.671] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x49d0, lpOverlapped=0x0) returned 1 [0132.672] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.687] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.690] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.697] CloseHandle (hObject=0x1a8) returned 1 [0132.697] CloseHandle (hObject=0x1ac) returned 1 [0132.697] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.698] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.698] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0132.698] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.698] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.698] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 1 [0132.699] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 0xffffffff [0132.699] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.699] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0132.699] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.699] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e80 [0132.699] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.699] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.699] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.699] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.700] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e96 [0132.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.700] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.707] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.748] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3e96, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3e96, lpOverlapped=0x0) returned 1 [0132.757] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3ea0, lpOverlapped=0x0) returned 1 [0132.758] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.772] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.776] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.783] CloseHandle (hObject=0x1ac) returned 1 [0132.783] CloseHandle (hObject=0x1a8) returned 1 [0132.783] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.784] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.784] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0132.784] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.784] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.784] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 1 [0132.785] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 0xffffffff [0132.785] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.785] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0132.785] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.785] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0132.787] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.787] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.788] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.789] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.789] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8b [0132.789] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.790] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.796] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.838] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3e8b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3e8b, lpOverlapped=0x0) returned 1 [0132.841] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3e90, lpOverlapped=0x0) returned 1 [0132.842] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.859] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.863] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.870] CloseHandle (hObject=0x1a8) returned 1 [0132.870] CloseHandle (hObject=0x1ac) returned 1 [0132.870] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.870] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.871] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0132.871] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.871] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.871] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 1 [0132.872] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 0xffffffff [0132.872] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.872] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0132.872] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.872] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0132.872] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.872] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.872] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.872] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.873] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x563d [0132.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.873] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.880] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0132.921] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x563d, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x563d, lpOverlapped=0x0) returned 1 [0132.928] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x5640, lpOverlapped=0x0) returned 1 [0132.942] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0132.961] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0132.966] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.972] CloseHandle (hObject=0x1ac) returned 1 [0132.972] CloseHandle (hObject=0x1a8) returned 1 [0132.973] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0132.973] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0132.973] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0132.973] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0132.974] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0132.974] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 1 [0132.974] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 0xffffffff [0132.975] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0132.975] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0132.975] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0132.975] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534e40 [0132.975] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.975] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0132.975] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0132.977] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0132.977] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5593 [0132.977] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0132.978] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0132.985] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.119] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5593, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x5593, lpOverlapped=0x0) returned 1 [0133.130] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x55a0, lpOverlapped=0x0) returned 1 [0133.131] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.146] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.151] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.158] CloseHandle (hObject=0x1a8) returned 1 [0133.158] CloseHandle (hObject=0x1ac) returned 1 [0133.158] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.159] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.159] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0133.159] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.159] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0133.159] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 1 [0133.160] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 0xffffffff [0133.160] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.160] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0133.160] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.160] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0133.160] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.160] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.160] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.160] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0133.161] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f64 [0133.161] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.161] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.170] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.212] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4f64, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x4f64, lpOverlapped=0x0) returned 1 [0133.225] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4f70, lpOverlapped=0x0) returned 1 [0133.226] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.241] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.244] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.251] CloseHandle (hObject=0x1ac) returned 1 [0133.251] CloseHandle (hObject=0x1a8) returned 1 [0133.251] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.252] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.252] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0133.252] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.252] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0133.252] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 1 [0133.253] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 0xffffffff [0133.253] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.253] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0133.253] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.253] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535080 [0133.253] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.253] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.253] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0133.254] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.255] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x404e [0133.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.255] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.262] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.303] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x404e, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x404e, lpOverlapped=0x0) returned 1 [0133.304] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4050, lpOverlapped=0x0) returned 1 [0133.305] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.320] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.324] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.330] CloseHandle (hObject=0x1a8) returned 1 [0133.330] CloseHandle (hObject=0x1ac) returned 1 [0133.330] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.331] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.331] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0133.331] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.331] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0133.331] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 1 [0133.332] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 0xffffffff [0133.332] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.332] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0133.332] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.332] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0133.332] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.332] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.333] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.333] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0133.333] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48f1 [0133.333] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.334] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.341] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.385] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x48f1, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x48f1, lpOverlapped=0x0) returned 1 [0133.387] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4900, lpOverlapped=0x0) returned 1 [0133.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.403] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.413] CloseHandle (hObject=0x1ac) returned 1 [0133.413] CloseHandle (hObject=0x1a8) returned 1 [0133.413] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.414] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.414] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x534e40 [0133.414] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.414] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0133.415] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 1 [0133.415] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 0xffffffff [0133.415] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.415] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0133.416] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.416] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0133.416] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.416] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.416] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0133.417] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.418] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x426b [0133.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.418] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.425] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.466] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x426b, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x426b, lpOverlapped=0x0) returned 1 [0133.467] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x4270, lpOverlapped=0x0) returned 1 [0133.468] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.483] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.487] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.493] CloseHandle (hObject=0x1a8) returned 1 [0133.493] CloseHandle (hObject=0x1ac) returned 1 [0133.493] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.494] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.494] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535040 [0133.494] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.494] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0133.494] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 1 [0133.495] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 0xffffffff [0133.495] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.495] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0133.495] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.495] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535200 [0133.495] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.495] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.496] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.496] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0133.496] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d11 [0133.496] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.497] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.503] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.548] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3d11, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3d11, lpOverlapped=0x0) returned 1 [0133.550] WriteFile (in: hFile=0x1a8, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3d20, lpOverlapped=0x0) returned 1 [0133.551] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.566] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.570] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.576] CloseHandle (hObject=0x1ac) returned 1 [0133.576] CloseHandle (hObject=0x1a8) returned 1 [0133.577] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.577] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.577] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0133.577] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.577] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0133.577] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 1 [0133.578] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 0xffffffff [0133.578] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.579] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0133.579] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.579] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534cc0 [0133.579] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.579] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0133.579] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a8 [0133.579] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.580] GetFileSize (in: hFile=0x1a8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d72 [0133.580] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.580] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.587] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.628] ReadFile (in: hFile=0x1a8, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3d72, lpNumberOfBytesRead=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19de3c*=0x3d72, lpOverlapped=0x0) returned 1 [0133.630] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x19de3c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19de3c*=0x3d80, lpOverlapped=0x0) returned 1 [0133.630] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.645] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.649] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.655] CloseHandle (hObject=0x1a8) returned 1 [0133.656] CloseHandle (hObject=0x1ac) returned 1 [0133.656] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.656] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.656] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535080 [0133.657] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0 [0133.657] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0133.657] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 1 [0133.657] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 0xffffffff [0133.658] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0133.658] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0133.658] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0133.658] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0133.658] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0133.658] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534e80 [0133.659] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.659] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.659] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0133.659] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.662] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7299 [0133.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.662] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.675] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.719] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x7299, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x7299, lpOverlapped=0x0) returned 1 [0133.724] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x72a0, lpOverlapped=0x0) returned 1 [0133.725] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.783] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.786] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.793] CloseHandle (hObject=0x1b0) returned 1 [0133.793] CloseHandle (hObject=0x1ac) returned 1 [0133.793] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.794] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.794] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0133.794] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0133.794] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0133.794] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 1 [0133.795] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 0xffffffff [0133.795] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0133.795] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0133.795] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0133.796] GetFileSize (in: hFile=0x1ac, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e39 [0133.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.796] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.862] ReadFile (in: hFile=0x1ac, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3e39, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e0a4*=0x3e39, lpOverlapped=0x0) returned 1 [0133.867] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e0a4*=0x3e40, lpOverlapped=0x0) returned 1 [0133.867] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.882] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.886] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.892] CloseHandle (hObject=0x1ac) returned 1 [0133.892] CloseHandle (hObject=0x1b0) returned 1 [0133.892] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.893] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.893] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534f00 [0133.893] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0133.893] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0133.893] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 1 [0133.894] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 0xffffffff [0133.894] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0133.894] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0133.894] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0133.894] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0133.894] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0133.894] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0133.894] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0133.894] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Temp\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534cc0 [0133.899] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0133.899] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0133.899] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0133.899] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0133.899] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0133.899] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0133.900] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0133.900] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0133.900] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0133.903] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0133.903] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b2e9 [0133.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0133.904] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0133.910] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0133.952] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2b2e9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x2b2e9, lpOverlapped=0x0) returned 1 [0133.968] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2b2f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x2b2f0, lpOverlapped=0x0) returned 1 [0133.971] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0133.985] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0133.989] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.996] CloseHandle (hObject=0x190) returned 1 [0133.996] CloseHandle (hObject=0x1a0) returned 1 [0133.996] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0133.996] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0133.996] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0133.997] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0133.997] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0133.997] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 1 [0133.998] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 0xffffffff [0133.998] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0133.999] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0133.999] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.000] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.000] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534cc0 [0134.001] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.001] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.001] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e80 [0134.100] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.101] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.101] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.101] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0134.102] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0134.102] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.102] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.108] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.157] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0x13e, lpOverlapped=0x0) returned 1 [0134.158] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x140, lpOverlapped=0x0) returned 1 [0134.159] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.181] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.186] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.200] CloseHandle (hObject=0x198) returned 1 [0134.200] CloseHandle (hObject=0x1a4) returned 1 [0134.200] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.201] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.201] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534f40 [0134.202] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0134.202] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0134.202] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log")) returned 1 [0134.203] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.com_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.com_0.indexeddb.leveldb\\000003.log")) returned 0xffffffff [0134.203] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.203] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.204] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.204] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.205] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0134.205] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0134.205] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.205] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x5351c0 [0134.235] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.235] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.236] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0134.236] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.237] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc [0134.237] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.237] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.244] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.336] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0x1dc, lpOverlapped=0x0) returned 1 [0134.337] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x1e0, lpOverlapped=0x0) returned 1 [0134.338] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.354] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.360] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.367] CloseHandle (hObject=0x1a4) returned 1 [0134.367] CloseHandle (hObject=0x198) returned 1 [0134.368] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.368] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.368] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534e40 [0134.369] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0134.369] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0134.369] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log")) returned 1 [0134.370] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\000003.log")) returned 0xffffffff [0134.370] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.370] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.370] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.371] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.371] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.373] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0134.375] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb4 [0134.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.375] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.382] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.454] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0xb4, lpOverlapped=0x0) returned 1 [0134.454] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0xc0, lpOverlapped=0x0) returned 1 [0134.455] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.473] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.479] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.485] CloseHandle (hObject=0x198) returned 1 [0134.485] CloseHandle (hObject=0x1a4) returned 1 [0134.485] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.486] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.486] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0134.486] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0134.486] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0134.486] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old")) returned 1 [0134.487] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\IndexedDB\\https_www.google.de_0.indexeddb.leveldb\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\indexeddb\\https_www.google.de_0.indexeddb.leveldb\\log.old")) returned 0xffffffff [0134.487] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.487] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0134.487] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0134.487] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0134.487] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0134.487] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.487] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0134.488] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.488] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.489] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.489] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0134.489] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0134.489] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.489] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x5353c0 [0134.490] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.490] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.491] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.491] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.491] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0134.491] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0134.491] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.492] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.492] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.492] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534cc0 [0134.492] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.492] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.492] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535040 [0134.508] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.508] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.508] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0134.510] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.511] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0134.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.511] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.518] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.559] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x10, lpOverlapped=0x0) returned 1 [0134.560] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.575] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.579] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.585] CloseHandle (hObject=0x1a4) returned 1 [0134.585] CloseHandle (hObject=0x198) returned 1 [0134.586] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.586] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.586] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0134.586] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0134.586] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0134.586] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 1 [0134.587] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 0xffffffff [0134.587] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.587] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.588] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.588] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.588] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.590] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0134.591] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbc [0134.591] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.591] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.598] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.639] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbc, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0xbc, lpOverlapped=0x0) returned 1 [0134.640] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0xc0, lpOverlapped=0x0) returned 1 [0134.641] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.656] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.659] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.667] CloseHandle (hObject=0x198) returned 1 [0134.667] CloseHandle (hObject=0x1a4) returned 1 [0134.667] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.668] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534f40 [0134.668] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0134.668] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0134.668] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old")) returned 1 [0134.669] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.old")) returned 0xffffffff [0134.669] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.669] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0134.669] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0134.669] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0134.669] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0134.669] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.669] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534ec0 [0134.698] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.698] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.699] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.699] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.700] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.700] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0134.700] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0134.701] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.701] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.702] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.702] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.703] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.703] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.703] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.704] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.704] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.705] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0134.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0134.707] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0134.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.707] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.717] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.759] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x4000, lpOverlapped=0x0) returned 1 [0134.768] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x4010, lpOverlapped=0x0) returned 1 [0134.769] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.784] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.788] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.794] CloseHandle (hObject=0x1a0) returned 1 [0134.794] CloseHandle (hObject=0x190) returned 1 [0134.794] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.795] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.795] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0134.795] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0134.795] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0134.795] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1 [0134.796] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0xffffffff [0134.796] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.796] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.797] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.797] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.798] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0134.798] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535200 [0134.799] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.799] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0134.799] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e40 [0134.804] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.804] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.804] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x5353c0 [0134.805] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0134.805] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0134.805] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\8c4d7305-348c-4e49-a93a-83143a3b9025\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534ec0 [0134.823] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.823] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.823] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.824] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.824] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.825] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.825] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.825] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\8c4d7305-348c-4e49-a93a-83143a3b9025\\index-dir\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0134.843] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0134.843] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0134.843] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0134.843] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0134.844] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0134.844] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0134.844] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0134.844] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0134.845] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0134.846] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a [0134.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0134.846] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0134.853] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0134.895] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5a, lpOverlapped=0x0) returned 1 [0134.895] WriteFile (in: hFile=0x1b0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0134.896] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0134.911] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0134.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.921] CloseHandle (hObject=0x198) returned 1 [0134.921] CloseHandle (hObject=0x1b0) returned 1 [0134.921] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0134.922] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0134.922] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534ec0 [0134.922] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0134.922] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0134.922] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt")) returned 1 [0134.923] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\28da9c56fde4021055a681112c092453f74d8dd8\\index.txt")) returned 0xffffffff [0134.923] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0134.923] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0134.923] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0134.923] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x535240 [0134.930] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0134.930] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0134.930] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\1eb73b7c-1f7e-4d77-acd3-5605781472f5\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x534cc0 [0134.944] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.944] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.945] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.945] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.946] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.946] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.946] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0134.946] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\1eb73b7c-1f7e-4d77-acd3-5605781472f5\\index-dir\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x5351c0 [0134.948] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0134.948] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0134.949] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0134.949] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0134.949] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0134.949] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0134.949] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0134.949] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\bf8f082f-6a47-47c8-a2cc-2761ce03ff32\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x5353c0 [0135.074] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.074] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.074] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.075] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.075] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.075] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.076] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.076] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.076] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.077] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.077] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.078] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.078] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.078] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.079] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.079] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0135.079] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\bf8f082f-6a47-47c8-a2cc-2761ce03ff32\\index-dir\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x535300 [0135.094] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0135.094] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0135.094] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0135.094] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0135.095] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0135.095] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0135.095] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0135.095] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0135.096] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.097] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a [0135.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.097] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.104] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.146] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e30c*=0x5a, lpOverlapped=0x0) returned 1 [0135.147] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19e30c, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e30c*=0x60, lpOverlapped=0x0) returned 1 [0135.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.163] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.167] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.173] CloseHandle (hObject=0x1b0) returned 1 [0135.173] CloseHandle (hObject=0x198) returned 1 [0135.173] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.174] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.174] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534d00 [0135.174] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0 [0135.174] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0135.174] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt")) returned 1 [0135.175] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\CacheStorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\cachestorage\\e6622492fa163609ddd4212f54512baa07929ed3\\index.txt")) returned 0xffffffff [0135.175] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0135.175] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0135.175] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0135.175] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0135.175] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.175] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x5353c0 [0135.177] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.177] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.178] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.179] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.180] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b2 [0135.180] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.180] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.186] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.227] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x8b2, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0x8b2, lpOverlapped=0x0) returned 1 [0135.229] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x8c0, lpOverlapped=0x0) returned 1 [0135.229] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.244] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.248] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.255] CloseHandle (hObject=0x1a4) returned 1 [0135.255] CloseHandle (hObject=0x198) returned 1 [0135.256] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.257] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.257] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0135.257] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0135.257] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0135.257] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log")) returned 1 [0135.258] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\000003.log")) returned 0xffffffff [0135.258] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.258] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.259] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.259] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.259] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.261] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.261] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15e [0135.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.262] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.268] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.311] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0x15e, lpOverlapped=0x0) returned 1 [0135.311] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x160, lpOverlapped=0x0) returned 1 [0135.312] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.327] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.330] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.337] CloseHandle (hObject=0x198) returned 1 [0135.337] CloseHandle (hObject=0x1a4) returned 1 [0135.337] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.338] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.338] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534e80 [0135.338] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0135.338] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0135.338] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old")) returned 1 [0135.339] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\Database\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\service worker\\database\\log.old")) returned 0xffffffff [0135.339] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.339] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0135.340] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0135.340] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.340] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\ScriptCache\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534cc0 [0135.352] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.352] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.353] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.353] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.354] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.354] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.355] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.355] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.356] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.356] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Service Worker\\ScriptCache\\index-dir\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x5351c0 [0135.363] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0135.363] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0135.363] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0135.363] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0135.364] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0135.364] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0135.364] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0135.364] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0135.364] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.364] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e40 [0135.368] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.368] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.369] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.369] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0135.371] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.371] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb08 [0135.371] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.371] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.378] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.421] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb08, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0xb08, lpOverlapped=0x0) returned 1 [0135.426] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0xb10, lpOverlapped=0x0) returned 1 [0135.427] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.441] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.452] CloseHandle (hObject=0x1a0) returned 1 [0135.452] CloseHandle (hObject=0x1a4) returned 1 [0135.452] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.453] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.453] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0135.453] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0135.453] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0135.453] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log")) returned 1 [0135.454] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\000004.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\000004.log")) returned 0xffffffff [0135.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.455] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.455] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.455] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.457] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0135.457] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e [0135.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.458] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.465] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.509] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x24e, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e7dc*=0x24e, lpOverlapped=0x0) returned 1 [0135.510] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e7dc*=0x250, lpOverlapped=0x0) returned 1 [0135.511] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.530] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.538] CloseHandle (hObject=0x1a4) returned 1 [0135.538] CloseHandle (hObject=0x1a0) returned 1 [0135.538] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.539] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.539] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535300 [0135.539] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0135.539] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0135.539] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old")) returned 1 [0135.540] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Session Storage\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\session storage\\log.old")) returned 0xffffffff [0135.540] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.540] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0135.540] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0135.540] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.541] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.541] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.541] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0135.541] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.541] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.541] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535300 [0135.545] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.545] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.546] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.548] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.549] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0135.549] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.549] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.556] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.600] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x10, lpOverlapped=0x0) returned 1 [0135.601] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.619] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.623] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.629] CloseHandle (hObject=0x1a4) returned 1 [0135.630] CloseHandle (hObject=0x198) returned 1 [0135.631] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.631] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.631] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0135.631] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0135.632] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0135.632] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log")) returned 1 [0135.632] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log")) returned 0xffffffff [0135.632] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.632] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.633] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.633] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.633] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.636] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.637] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a0 [0135.637] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.637] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.644] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.704] ReadFile (in: hFile=0x198, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0x1a0, lpOverlapped=0x0) returned 1 [0135.705] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x1b0, lpOverlapped=0x0) returned 1 [0135.705] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.724] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.728] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.734] CloseHandle (hObject=0x198) returned 1 [0135.734] CloseHandle (hObject=0x1a4) returned 1 [0135.735] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.735] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.735] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0135.735] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0135.735] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0135.735] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old")) returned 1 [0135.736] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.old" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.old")) returned 0xffffffff [0135.736] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.737] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0135.737] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0135.737] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0135.737] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0135.737] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.737] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.738] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.738] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.738] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.738] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535000 [0135.739] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.739] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.739] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x5351c0 [0135.739] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.739] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.739] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0135.739] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0135.742] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28df6 [0135.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.743] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.749] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.796] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x28df6, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19e574*=0x28df6, lpOverlapped=0x0) returned 1 [0135.813] WriteFile (in: hFile=0x198, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x28e00, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19e574*=0x28e00, lpOverlapped=0x0) returned 1 [0135.815] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0135.830] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0135.834] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.840] CloseHandle (hObject=0x1a4) returned 1 [0135.840] CloseHandle (hObject=0x198) returned 1 [0135.843] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0135.844] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0135.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534e40 [0135.844] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0135.844] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0135.844] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 1 [0135.846] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 0xffffffff [0135.846] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0135.846] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0135.847] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0135.847] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0135.847] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0135.847] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.847] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.847] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.847] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0135.848] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.848] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0135.848] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.848] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.848] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0135.848] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.848] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0135.848] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.848] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.848] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0135.848] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.848] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.849] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.849] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0135.928] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.928] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.928] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0135.928] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.928] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0135.936] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.936] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.936] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0135.936] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.936] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0135.937] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.937] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.937] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0135.937] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.937] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.938] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.938] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.938] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.939] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.939] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.940] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.940] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.941] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.941] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.942] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.942] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.942] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.943] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0135.944] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.944] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0135.944] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Unindexed Rules\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534c80 [0135.944] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0135.944] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.944] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0135.944] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.944] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.945] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0135.945] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0135.945] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0135.945] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0135.945] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0135.945] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0135.945] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Google\\CrashReports\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0135.945] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0135.945] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0135.945] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0135.945] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0135.945] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\History\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0xffffffff [0135.945] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0135.946] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x194 [0135.946] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x18c [0135.946] GetFileSize (in: hFile=0x194, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x600000 [0135.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0135.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0135.953] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0135.996] ReadFile (in: hFile=0x194, lpBuffer=0x1d46ff4, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46ff4*, lpNumberOfBytesRead=0x19f3e4*=0x500000, lpOverlapped=0x0) returned 1 [0136.176] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46ff4*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46ff4*, lpNumberOfBytesWritten=0x19f3e4*=0x500000, lpOverlapped=0x0) returned 1 [0136.249] ReadFile (in: hFile=0x194, lpBuffer=0x1d46ff4, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46ff4*, lpNumberOfBytesRead=0x19f3e4*=0x100000, lpOverlapped=0x0) returned 1 [0136.268] WriteFile (in: hFile=0x18c, lpBuffer=0x1d46ff4*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19f3e4, lpOverlapped=0x0 | out: lpBuffer=0x1d46ff4*, lpNumberOfBytesWritten=0x19f3e4*=0x100010, lpOverlapped=0x0) returned 1 [0136.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.299] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.303] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.310] CloseHandle (hObject=0x194) returned 1 [0136.310] CloseHandle (hObject=0x18c) returned 1 [0136.310] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.310] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.311] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535300 [0136.311] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0 [0136.311] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0136.311] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db")) returned 1 [0136.319] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\iconcache.db")) returned 0xffffffff [0136.319] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0136.319] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0136.319] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0136.319] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0136.319] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0136.319] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.319] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.319] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5353c0 [0136.340] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.340] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.340] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0136.382] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0136.383] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14 [0136.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.383] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.389] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0136.438] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47054, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesRead=0x19ecac*=0x14, lpOverlapped=0x0) returned 1 [0136.439] WriteFile (in: hFile=0x190, lpBuffer=0x1d47054*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0136.439] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.454] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.458] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.464] CloseHandle (hObject=0x19c) returned 1 [0136.465] CloseHandle (hObject=0x190) returned 1 [0136.465] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.465] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.465] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0136.465] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0136.465] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0136.465] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log")) returned 1 [0136.466] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\WINPROJ.EXE.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\winproj.exe.log")) returned 0xffffffff [0136.466] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0136.466] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0136.466] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0136.466] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0136.466] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0136.466] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535080 [0136.467] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.467] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0136.467] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0136.468] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f4 [0136.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.468] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.512] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0136.560] ReadFile (in: hFile=0x188, lpBuffer=0x1d4706c, nNumberOfBytesToRead=0x2f4, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4706c*, lpNumberOfBytesRead=0x19ef14*=0x2f4, lpOverlapped=0x0) returned 1 [0136.573] WriteFile (in: hFile=0x190, lpBuffer=0x1d4706c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4706c*, lpNumberOfBytesWritten=0x19ef14*=0x300, lpOverlapped=0x0) returned 1 [0136.573] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.589] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.600] CloseHandle (hObject=0x188) returned 1 [0136.600] CloseHandle (hObject=0x190) returned 1 [0136.600] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.600] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.600] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535380 [0136.601] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0136.601] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0136.601] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log")) returned 1 [0136.601] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\ngen.log")) returned 0xffffffff [0136.601] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.601] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0136.605] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.605] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.605] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0136.605] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0136.605] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91e [0136.606] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.606] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.612] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0136.656] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x91e, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ecac*=0x91e, lpOverlapped=0x0) returned 1 [0136.658] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ecac*=0x920, lpOverlapped=0x0) returned 1 [0136.659] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.675] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.685] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.692] CloseHandle (hObject=0x188) returned 1 [0136.692] CloseHandle (hObject=0x19c) returned 1 [0136.692] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.693] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.693] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0136.693] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0136.693] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0136.693] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log")) returned 1 [0136.694] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\mmc.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\mmc.exe.log")) returned 0xffffffff [0136.694] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.694] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0136.695] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0136.696] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x282 [0136.696] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.696] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.703] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0136.751] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x282, lpOverlapped=0x0) returned 1 [0136.763] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x290, lpOverlapped=0x0) returned 1 [0136.764] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.780] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.790] CloseHandle (hObject=0x19c) returned 1 [0136.790] CloseHandle (hObject=0x188) returned 1 [0136.790] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.791] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.791] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0136.791] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0136.791] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0136.791] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log")) returned 1 [0136.792] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\ngentask.exe.log")) returned 0xffffffff [0136.792] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.793] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0136.794] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0136.794] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea4 [0136.795] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.795] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.802] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0136.848] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0xea4, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0xea4, lpOverlapped=0x0) returned 1 [0136.865] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0xeb0, lpOverlapped=0x0) returned 1 [0136.866] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.881] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.885] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.892] CloseHandle (hObject=0x188) returned 1 [0136.892] CloseHandle (hObject=0x19c) returned 1 [0136.892] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.892] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.892] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0136.893] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0136.893] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0136.893] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log")) returned 1 [0136.894] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\powershell.exe.log")) returned 0xffffffff [0136.894] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0136.894] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0136.894] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0136.894] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x155a [0136.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.895] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.902] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0136.946] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x155a, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x155a, lpOverlapped=0x0) returned 1 [0136.962] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x1560, lpOverlapped=0x0) returned 1 [0136.963] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0136.977] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0136.981] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.987] CloseHandle (hObject=0x19c) returned 1 [0136.987] CloseHandle (hObject=0x188) returned 1 [0136.987] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0136.988] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0136.988] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0136.988] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0136.988] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0136.988] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log")) returned 1 [0136.989] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\sdiagnhost.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\sdiagnhost.exe.log")) returned 0xffffffff [0136.989] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0136.989] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0136.989] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0136.989] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0136.990] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0136.990] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534ec0 [0136.990] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.990] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0136.990] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0136.990] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0136.992] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ef [0136.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0136.992] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0136.999] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.120] ReadFile (in: hFile=0x190, lpBuffer=0x1d47070, nNumberOfBytesToRead=0x2ef, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesRead=0x19ef14*=0x2ef, lpOverlapped=0x0) returned 1 [0137.136] WriteFile (in: hFile=0x188, lpBuffer=0x1d47070*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesWritten=0x19ef14*=0x2f0, lpOverlapped=0x0) returned 1 [0137.137] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.155] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.158] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.165] CloseHandle (hObject=0x190) returned 1 [0137.165] CloseHandle (hObject=0x188) returned 1 [0137.165] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.165] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0137.165] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535300 [0137.166] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0137.166] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0137.166] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log")) returned 1 [0137.166] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\ngen.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\ngen.log")) returned 0xffffffff [0137.166] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.167] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0137.167] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.167] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.167] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.170] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0137.173] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x205 [0137.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.173] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.181] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.221] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x205, lpOverlapped=0x0) returned 1 [0137.227] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x210, lpOverlapped=0x0) returned 1 [0137.228] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.243] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.246] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.253] CloseHandle (hObject=0x190) returned 1 [0137.253] CloseHandle (hObject=0x19c) returned 1 [0137.253] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.253] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0137.254] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0137.254] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0137.254] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0137.254] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log")) returned 1 [0137.255] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\NGenTask.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\ngentask.exe.log")) returned 0xffffffff [0137.255] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0137.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.256] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb8f [0137.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.256] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.263] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.306] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47084, nNumberOfBytesToRead=0xb8f, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0xb8f, lpOverlapped=0x0) returned 1 [0137.313] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0xb90, lpOverlapped=0x0) returned 1 [0137.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.329] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.339] CloseHandle (hObject=0x19c) returned 1 [0137.339] CloseHandle (hObject=0x190) returned 1 [0137.339] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.340] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0137.340] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0137.340] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0137.340] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0137.340] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log")) returned 1 [0137.341] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\powershell.exe.log")) returned 0xffffffff [0137.341] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.341] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0137.341] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.341] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0137.341] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.341] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535380 [0137.341] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.341] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.342] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.342] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0137.342] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.342] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e80 [0137.343] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.343] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.343] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0137.343] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.343] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f40 [0137.344] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.344] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.345] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.345] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0137.345] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.345] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.346] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.346] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0137.346] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.346] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0137.346] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.346] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f00 [0137.346] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.346] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.346] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\6YGNCJW8\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0137.348] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.348] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.348] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0137.348] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.348] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0137.348] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.349] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0137.349] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.351] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.357] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.404] WriteFile (in: hFile=0x190, lpBuffer=0x1d47074*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47074*, lpNumberOfBytesWritten=0x19ef14*=0x10, lpOverlapped=0x0) returned 1 [0137.405] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.420] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.431] CloseHandle (hObject=0x188) returned 1 [0137.431] CloseHandle (hObject=0x190) returned 1 [0137.431] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.432] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0137.432] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534ec0 [0137.432] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0137.433] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0137.433] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat")) returned 1 [0137.433] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\feeds cache\\container.dat")) returned 0xffffffff [0137.433] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.433] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\FZW2QEOY\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0137.433] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.433] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.433] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0137.433] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.433] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\O593F7EE\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0137.434] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.434] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.434] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.434] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0137.434] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.434] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Feeds Cache\\PJ5H3B54\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0137.435] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.435] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.435] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0137.435] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.435] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0137.435] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.435] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0137.435] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.435] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.435] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.440] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0137.440] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3b4 [0137.440] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.440] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.447] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.497] ReadFile (in: hFile=0x190, lpBuffer=0x1d47070, nNumberOfBytesToRead=0x3e3b4, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesRead=0x19ef14*=0x3e3b4, lpOverlapped=0x0) returned 1 [0137.516] WriteFile (in: hFile=0x188, lpBuffer=0x1d47070*, nNumberOfBytesToWrite=0x3e3c0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesWritten=0x19ef14*=0x3e3c0, lpOverlapped=0x0) returned 1 [0137.519] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.533] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.549] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.558] CloseHandle (hObject=0x190) returned 1 [0137.558] CloseHandle (hObject=0x188) returned 1 [0137.558] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.559] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0137.559] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535300 [0137.559] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0137.559] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0137.559] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat")) returned 1 [0137.561] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\FORMS\\FRMDATA64.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\forms\\frmdata64.dat")) returned 0xffffffff [0137.561] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.561] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0137.561] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0137.561] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.561] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0137.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.562] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98d0 [0137.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.562] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.569] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.618] ReadFile (in: hFile=0x188, lpBuffer=0x1d47074, nNumberOfBytesToRead=0x98d0, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47074*, lpNumberOfBytesRead=0x19ef14*=0x98d0, lpOverlapped=0x0) returned 1 [0137.618] WriteFile (in: hFile=0x190, lpBuffer=0x1d47074*, nNumberOfBytesToWrite=0x98e0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47074*, lpNumberOfBytesWritten=0x19ef14*=0x98e0, lpOverlapped=0x0) returned 1 [0137.619] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.635] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.645] CloseHandle (hObject=0x188) returned 1 [0137.645] CloseHandle (hObject=0x190) returned 1 [0137.646] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0137.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0137.646] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0137.646] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0137.647] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin")) returned 0 [0137.647] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\gamedvr\\knowngamelist.bin")) returned 0x20 [0137.647] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.647] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0137.647] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.647] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\InputPersonalization\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0137.647] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.647] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.647] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535400 [0137.649] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.649] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.649] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0137.649] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0137.649] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0137.649] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0137.649] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535200 [0137.650] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.650] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.650] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.651] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0137.651] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19b7 [0137.651] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.651] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.659] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.709] ReadFile (in: hFile=0x190, lpBuffer=0x1d47078, nNumberOfBytesToRead=0x19b7, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesRead=0x19ef14*=0x19b7, lpOverlapped=0x0) returned 1 [0137.710] WriteFile (in: hFile=0x188, lpBuffer=0x1d47078*, nNumberOfBytesToWrite=0x19c0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesWritten=0x19ef14*=0x19c0, lpOverlapped=0x0) returned 1 [0137.711] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.728] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.732] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.738] CloseHandle (hObject=0x190) returned 1 [0137.738] CloseHandle (hObject=0x188) returned 1 [0137.738] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.739] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0137.739] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0137.739] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0137.739] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0137.739] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0137.740] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0137.740] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.740] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0137.742] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.742] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.742] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.742] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0137.742] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.742] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0137.742] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.742] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.742] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\37JGORX3\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0137.744] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0137.744] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0137.744] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0137.744] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.744] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\52UK17NV\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0137.744] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0137.744] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0137.745] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0137.745] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0137.745] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.745] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.745] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0137.751] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0137.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.751] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.758] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.800] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0137.800] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.815] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.826] CloseHandle (hObject=0x190) returned 1 [0137.826] CloseHandle (hObject=0x19c) returned 1 [0137.826] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.827] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0137.827] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0137.827] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0137.827] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0137.827] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat")) returned 1 [0137.827] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\domstore\\container.dat")) returned 0xffffffff [0137.828] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.828] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\L8OQST1L\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0137.830] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0137.830] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0137.830] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0137.830] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0137.830] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.830] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Q6TJEFY5\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0137.830] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0137.830] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0137.830] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0137.830] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.830] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0137.830] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.830] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0137.831] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.831] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.831] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0137.831] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.831] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0137.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.832] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.839] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.892] WriteFile (in: hFile=0x190, lpBuffer=0x1d47090*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47090*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0137.893] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.910] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0137.915] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.922] CloseHandle (hObject=0x19c) returned 1 [0137.922] CloseHandle (hObject=0x190) returned 1 [0137.922] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0137.923] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0137.923] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0137.923] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0137.923] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0137.923] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat")) returned 1 [0137.923] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat")) returned 0xffffffff [0137.924] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0137.924] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0137.924] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0137.924] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534ec0 [0137.924] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.924] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0137.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0137.924] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0137.925] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0137.925] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0137.925] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0137.933] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0137.979] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0137.980] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0137.997] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.000] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.098] CloseHandle (hObject=0x190) returned 1 [0138.098] CloseHandle (hObject=0x19c) returned 1 [0138.098] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.099] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0138.099] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0138.099] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0138.099] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0138.099] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat")) returned 1 [0138.100] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\container.dat")) returned 0xffffffff [0138.100] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.100] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0138.100] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.100] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0138.100] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.100] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.100] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0138.100] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.101] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0138.101] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.101] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.108] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.155] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0138.156] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.172] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.176] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.182] CloseHandle (hObject=0x19c) returned 1 [0138.182] CloseHandle (hObject=0x190) returned 1 [0138.183] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.183] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0138.183] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0138.183] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0138.183] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0138.184] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat")) returned 1 [0138.184] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\container.dat")) returned 0xffffffff [0138.184] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.184] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.184] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.184] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0138.187] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.187] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3aa [0138.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.188] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.195] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.239] ReadFile (in: hFile=0x188, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x3aa, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ef14*=0x3aa, lpOverlapped=0x0) returned 1 [0138.251] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ef14*=0x3b0, lpOverlapped=0x0) returned 1 [0138.251] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.267] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.271] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.277] CloseHandle (hObject=0x188) returned 1 [0138.277] CloseHandle (hObject=0x190) returned 1 [0138.278] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.278] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0138.278] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0138.279] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0138.279] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0138.279] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log")) returned 1 [0138.280] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-ClearIconCache.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-cleariconcache.log")) returned 0xffffffff [0138.280] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.280] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.280] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0138.280] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x514 [0138.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.281] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.288] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.330] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x514, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ef14*=0x514, lpOverlapped=0x0) returned 1 [0138.339] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ef14*=0x520, lpOverlapped=0x0) returned 1 [0138.339] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.361] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.364] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.371] CloseHandle (hObject=0x190) returned 1 [0138.371] CloseHandle (hObject=0x188) returned 1 [0138.371] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.372] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0138.372] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e40 [0138.372] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0138.372] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.372] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log")) returned 1 [0138.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\ie4uinit-UserConfig.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ie4uinit-userconfig.log")) returned 0xffffffff [0138.373] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.373] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534ec0 [0138.379] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.379] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.379] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.379] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0138.379] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.379] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0138.379] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.379] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.379] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.380] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0138.381] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0138.381] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.381] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.387] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.436] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0138.437] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.455] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.461] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.467] CloseHandle (hObject=0x190) returned 1 [0138.467] CloseHandle (hObject=0x19c) returned 1 [0138.467] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.468] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0138.468] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0138.468] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0138.468] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.468] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat")) returned 1 [0138.469] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\container.dat")) returned 0xffffffff [0138.469] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.469] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0138.469] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.469] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0138.469] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.469] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.469] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\dc8m5rh\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0138.469] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.469] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.469] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0138.469] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.470] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0138.470] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.470] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.470] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.474] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0138.475] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1614 [0138.475] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.475] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.482] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.523] ReadFile (in: hFile=0x190, lpBuffer=0x1d47090, nNumberOfBytesToRead=0x1614, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47090*, lpNumberOfBytesRead=0x19ea44*=0x1614, lpOverlapped=0x0) returned 1 [0138.535] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47090*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47090*, lpNumberOfBytesWritten=0x19ea44*=0x1620, lpOverlapped=0x0) returned 1 [0138.536] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.551] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.561] CloseHandle (hObject=0x190) returned 1 [0138.561] CloseHandle (hObject=0x1a0) returned 1 [0138.561] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.562] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0138.562] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0138.562] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0138.562] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0138.562] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat")) returned 1 [0138.563] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\sl72e5n\\imagestore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\imagestore\\sl72e5n\\imagestore.dat")) returned 0xffffffff [0138.563] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.563] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0138.563] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.563] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.563] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.563] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0138.563] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0138.564] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbfe0 [0138.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.564] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.573] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.614] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ef14*=0xbfe0, lpOverlapped=0x0) returned 1 [0138.617] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ef14*=0xbff0, lpOverlapped=0x0) returned 1 [0138.618] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.633] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.636] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.643] CloseHandle (hObject=0x188) returned 1 [0138.643] CloseHandle (hObject=0x19c) returned 1 [0138.643] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.644] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0138.644] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0138.644] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0138.644] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0138.644] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 1 [0138.645] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 0xffffffff [0138.645] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.645] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0138.645] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.645] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0138.646] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.646] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.646] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0138.646] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0138.647] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.647] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.648] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0138.648] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.648] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a00 [0138.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.648] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.656] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.705] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d470bc, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470bc*, lpNumberOfBytesRead=0x19ea44*=0x1a00, lpOverlapped=0x0) returned 1 [0138.707] WriteFile (in: hFile=0x190, lpBuffer=0x1d470bc*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470bc*, lpNumberOfBytesWritten=0x19ea44*=0x1a10, lpOverlapped=0x0) returned 1 [0138.708] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.723] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.730] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.738] CloseHandle (hObject=0x1a0) returned 1 [0138.738] CloseHandle (hObject=0x190) returned 1 [0138.738] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.739] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0138.739] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0138.739] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0138.740] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0138.740] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat")) returned 1 [0138.741] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{63E26EB7-6816-11E7-9BD2-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{63e26eb7-6816-11e7-9bd2-c40142ecde47}.dat")) returned 0xffffffff [0138.741] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.741] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0138.741] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0138.742] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3200 [0138.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.742] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.750] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.796] ReadFile (in: hFile=0x190, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x3200, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ea44*=0x3200, lpOverlapped=0x0) returned 1 [0138.797] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ea44*=0x3210, lpOverlapped=0x0) returned 1 [0138.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0138.813] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0138.816] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.823] CloseHandle (hObject=0x190) returned 1 [0138.823] CloseHandle (hObject=0x1a0) returned 1 [0138.823] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0138.824] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0138.824] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0138.824] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0138.824] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.824] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat")) returned 1 [0138.825] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{94C50253-C9AC-11E7-9BDD-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{94c50253-c9ac-11e7-9bdd-c40142ecde47}.dat")) returned 0xffffffff [0138.825] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.825] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0138.825] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.825] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0138.825] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.825] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\TabRoaming\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0138.825] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.825] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.825] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0138.825] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.825] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0138.825] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.826] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.826] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin-314712940\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0138.826] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.826] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.826] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.826] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.826] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.826] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Tiles\\pin7226654530\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0138.828] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.828] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.828] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0138.828] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.829] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0138.829] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.829] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\Tracking Protection\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0138.829] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.829] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.829] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.829] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.829] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Internet Explorer\\VersionManager\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0138.829] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.829] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.829] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.829] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0138.829] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0138.830] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0138.830] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0138.830] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534c80 [0138.830] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.830] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.830] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0138.830] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.830] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.830] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0138.832] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.832] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.832] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00009376\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534f40 [0138.836] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.836] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.836] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.837] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.837] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.838] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.838] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.839] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.839] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.840] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.840] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.841] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.841] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.841] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0138.841] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0138.842] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.842] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0138.842] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.842] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.842] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.842] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0138.844] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.844] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.844] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0138.844] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0138.844] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0138.844] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0138.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0138.844] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.844] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0138.845] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.845] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.845] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\BackstageInAppNavCache\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0138.846] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.846] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.846] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\BackstageInAppNavCache\\MyComputer\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535380 [0138.847] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.847] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0138.847] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0138.847] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.847] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0138.847] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.848] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.848] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.849] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.849] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.850] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.850] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.850] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.851] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.851] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.852] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.852] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.853] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.853] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.853] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0138.853] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.854] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.854] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534ec0 [0138.854] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.854] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.854] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\cdn.odc.officeapps.live.com\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534f00 [0138.865] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.865] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.865] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0138.865] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0138.866] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.866] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\clienttemplates.content.office.net\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535400 [0138.880] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.885] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.885] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.886] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.886] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.887] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.887] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.888] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.888] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.889] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.889] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.890] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.890] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.890] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.891] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.891] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.892] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.892] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.893] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.893] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.894] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.895] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.895] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.895] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.896] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.901] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.901] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.902] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.902] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.903] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.903] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.904] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.904] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.905] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.905] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.906] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.906] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.907] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.907] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.908] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.908] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.909] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.909] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.910] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.910] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.911] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.911] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.912] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.912] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.915] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.915] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.916] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.916] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.917] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.917] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.918] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.918] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.919] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.919] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.919] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0138.920] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0138.920] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.920] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535240 [0138.921] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.921] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.921] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.922] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.922] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.923] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0138.923] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0138.923] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0138.924] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0138.924] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0138.924] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.924] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0138.924] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.924] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0138.924] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.924] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0138.924] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\AppCommands\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534ec0 [0138.925] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0138.925] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0138.926] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0138.926] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0138.926] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0138.926] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.926] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.926] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.927] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0138.927] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.927] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Office\\OTele\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0138.927] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.927] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0138.927] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0138.927] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.927] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.928] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0138.928] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0138.928] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0138.928] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0138.928] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.928] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0138.928] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0138.936] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.936] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0138.937] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0138.937] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0138.938] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123c [0138.938] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0138.938] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0138.945] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0138.987] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x123c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x123c, lpOverlapped=0x0) returned 1 [0138.992] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x1240, lpOverlapped=0x0) returned 1 [0138.993] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.090] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.093] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.100] CloseHandle (hObject=0x188) returned 1 [0139.100] CloseHandle (hObject=0x1a0) returned 1 [0139.100] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.101] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.101] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0139.101] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.101] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0139.101] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png")) returned 1 [0139.102] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplaylogo.png")) returned 0xffffffff [0139.102] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.102] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.104] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.104] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d8f6 [0139.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.104] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.111] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.157] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x5d8f6, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x5d8f6, lpOverlapped=0x0) returned 1 [0139.176] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x5d900, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x5d900, lpOverlapped=0x0) returned 1 [0139.181] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.199] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.209] CloseHandle (hObject=0x1a0) returned 1 [0139.209] CloseHandle (hObject=0x188) returned 1 [0139.210] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.210] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.210] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0139.211] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.211] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0139.211] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif")) returned 1 [0139.214] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.gif")) returned 0xffffffff [0139.214] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.214] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.214] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.215] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27f2 [0139.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.215] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.223] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.267] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x27f2, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x27f2, lpOverlapped=0x0) returned 1 [0139.278] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x2800, lpOverlapped=0x0) returned 1 [0139.279] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.296] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.307] CloseHandle (hObject=0x188) returned 1 [0139.308] CloseHandle (hObject=0x1a0) returned 1 [0139.308] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.308] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.309] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0139.309] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.309] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0139.309] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png")) returned 1 [0139.310] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\autoplayoptin.png")) returned 0xffffffff [0139.310] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.310] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.312] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.312] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16da [0139.313] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.313] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.320] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.364] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x16da, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ecac*=0x16da, lpOverlapped=0x0) returned 1 [0139.388] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0x16e0, lpOverlapped=0x0) returned 1 [0139.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.403] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.414] CloseHandle (hObject=0x1a0) returned 1 [0139.414] CloseHandle (hObject=0x188) returned 1 [0139.414] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.415] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.415] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0139.415] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.415] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0139.415] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat")) returned 1 [0139.416] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\collectonedrivelogs.bat")) returned 0xffffffff [0139.416] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.416] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.417] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.417] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72c0 [0139.417] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.418] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.424] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.481] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x72c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x72c0, lpOverlapped=0x0) returned 1 [0139.483] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x72d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x72d0, lpOverlapped=0x0) returned 1 [0139.484] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.498] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.502] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.509] CloseHandle (hObject=0x188) returned 1 [0139.509] CloseHandle (hObject=0x1a0) returned 1 [0139.509] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.510] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.510] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0139.510] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.510] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0139.510] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll")) returned 1 [0139.511] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626\\etwlog.dll")) returned 0xffffffff [0139.511] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.511] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.511] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\is\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0139.511] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0139.511] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0139.512] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0139.512] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0139.512] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.512] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\it\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0139.514] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0139.514] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0139.514] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0139.514] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0139.514] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.514] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626\\ja\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0139.515] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0139.515] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0139.515] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0139.515] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0139.515] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0139.515] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0139.515] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0139.524] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.524] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.524] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.534] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.535] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123c [0139.535] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.535] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.541] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.583] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x123c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x123c, lpOverlapped=0x0) returned 1 [0139.591] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x1240, lpOverlapped=0x0) returned 1 [0139.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.606] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.611] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.619] CloseHandle (hObject=0x1a0) returned 1 [0139.619] CloseHandle (hObject=0x188) returned 1 [0139.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0139.620] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.620] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0139.620] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png")) returned 1 [0139.621] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplaylogo.png")) returned 0xffffffff [0139.621] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.621] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.623] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.624] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d8f6 [0139.624] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.624] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.631] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.674] ReadFile (in: hFile=0x188, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x5d8f6, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x5d8f6, lpOverlapped=0x0) returned 1 [0139.695] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x5d900, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x5d900, lpOverlapped=0x0) returned 1 [0139.701] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.716] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.730] CloseHandle (hObject=0x188) returned 1 [0139.730] CloseHandle (hObject=0x1a0) returned 1 [0139.730] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.731] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.731] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0139.731] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.731] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0139.731] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif")) returned 1 [0139.734] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.gif")) returned 0xffffffff [0139.734] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.734] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.736] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.737] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27f2 [0139.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.737] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.744] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.790] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x27f2, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x27f2, lpOverlapped=0x0) returned 1 [0139.807] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x2800, lpOverlapped=0x0) returned 1 [0139.808] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.822] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.843] CloseHandle (hObject=0x1a0) returned 1 [0139.843] CloseHandle (hObject=0x188) returned 1 [0139.843] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.844] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0139.844] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.844] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0139.844] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png")) returned 1 [0139.845] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\autoplayoptin.png")) returned 0xffffffff [0139.845] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.845] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.849] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.849] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16da [0139.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.850] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.857] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0139.931] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x16da, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ecac*=0x16da, lpOverlapped=0x0) returned 1 [0139.945] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0x16e0, lpOverlapped=0x0) returned 1 [0139.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0139.963] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0139.967] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.974] CloseHandle (hObject=0x188) returned 1 [0139.974] CloseHandle (hObject=0x1a0) returned 1 [0139.975] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0139.975] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0139.975] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0139.976] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0139.976] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0139.976] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat")) returned 1 [0139.977] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\collectonedrivelogs.bat")) returned 0xffffffff [0139.977] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0139.977] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0139.977] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0139.978] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72c0 [0139.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0139.978] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0139.985] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0140.114] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x72c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x72c0, lpOverlapped=0x0) returned 1 [0140.118] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x72d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x72d0, lpOverlapped=0x0) returned 1 [0140.119] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0140.134] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0140.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.144] CloseHandle (hObject=0x1a0) returned 1 [0140.144] CloseHandle (hObject=0x188) returned 1 [0140.144] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0140.145] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0140.145] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0140.145] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0140.145] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0140.145] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll")) returned 1 [0140.146] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\etwlog.dll")) returned 0xffffffff [0140.146] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.147] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.147] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0140.150] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0140.170] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x140c0 [0140.170] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0140.170] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0140.177] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0140.220] ReadFile (in: hFile=0x188, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x140c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x140c0, lpOverlapped=0x0) returned 1 [0140.240] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x140d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x140d0, lpOverlapped=0x0) returned 1 [0140.242] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0140.257] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0140.260] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.267] CloseHandle (hObject=0x188) returned 1 [0140.267] CloseHandle (hObject=0x1a0) returned 1 [0140.267] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0140.268] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0140.268] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0140.268] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0140.268] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0140.268] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll")) returned 1 [0140.269] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.localizedresources.dll")) returned 0xffffffff [0140.269] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.269] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0140.270] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0140.270] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28d8c0 [0140.270] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0140.270] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0140.278] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0140.324] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x28d8c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ecac*=0x28d8c0, lpOverlapped=0x0) returned 1 [0140.517] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x28d8d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0x28d8d0, lpOverlapped=0x0) returned 1 [0140.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0140.571] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0140.575] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.583] CloseHandle (hObject=0x1a0) returned 1 [0140.584] CloseHandle (hObject=0x188) returned 1 [0140.584] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0140.585] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0140.585] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0140.585] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0140.585] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0140.585] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll")) returned 1 [0140.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesync.resources.dll")) returned 0xffffffff [0140.591] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.591] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0140.591] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0140.592] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x362c0 [0140.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0140.592] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0140.599] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0140.646] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x362c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x362c0, lpOverlapped=0x0) returned 1 [0140.660] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x362d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x362d0, lpOverlapped=0x0) returned 1 [0140.664] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0140.689] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0140.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.700] CloseHandle (hObject=0x188) returned 1 [0140.700] CloseHandle (hObject=0x1a0) returned 1 [0140.701] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0140.701] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0140.701] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0140.702] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0140.702] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0140.702] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll")) returned 1 [0140.704] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncapi.dll")) returned 0xffffffff [0140.704] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.704] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0140.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0140.707] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d9ec0 [0140.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0140.707] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0140.716] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0140.773] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x1d9ec0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x1d9ec0, lpOverlapped=0x0) returned 1 [0140.858] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x1d9ed0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x1d9ed0, lpOverlapped=0x0) returned 1 [0140.883] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0140.898] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0140.902] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.908] CloseHandle (hObject=0x1a0) returned 1 [0140.909] CloseHandle (hObject=0x188) returned 1 [0140.909] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0140.909] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0140.909] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0140.909] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0140.910] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0140.910] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll")) returned 1 [0140.918] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncclient.dll")) returned 0xffffffff [0140.918] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.919] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0140.919] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0140.920] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0140.921] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1464c0 [0140.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0140.921] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0140.928] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0140.976] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x1464c0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ecac*=0x1464c0, lpOverlapped=0x0) returned 1 [0141.090] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x1464d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0x1464d0, lpOverlapped=0x0) returned 1 [0141.108] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0141.123] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0141.127] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.135] CloseHandle (hObject=0x188) returned 1 [0141.135] CloseHandle (hObject=0x1a0) returned 1 [0141.135] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0141.136] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0141.136] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535400 [0141.136] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0141.136] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0141.136] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll")) returned 1 [0141.138] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_1\\filesyncsessions.dll")) returned 0xffffffff [0141.138] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.138] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\is\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0141.139] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.139] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.139] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.139] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0141.139] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.139] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\it\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0141.139] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.139] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.140] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.140] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0141.140] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.140] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ja\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0141.140] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.140] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.141] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.141] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0141.141] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.141] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\ka\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0141.141] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.141] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.142] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.142] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0141.142] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.142] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\kk\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0141.142] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.142] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.142] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.142] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0141.142] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.142] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_1\\km-kh\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0141.142] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.143] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.143] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0141.143] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0141.143] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0141.143] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0141.143] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535080 [0141.143] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.160] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.161] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0141.161] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0141.161] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5ed0 [0141.161] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0141.162] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0141.170] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0141.235] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xd5ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ecac*=0xd5ed0, lpOverlapped=0x0) returned 1 [0141.266] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xd5ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ecac*=0xd5ee0, lpOverlapped=0x0) returned 1 [0141.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0141.301] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0141.305] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.312] CloseHandle (hObject=0x1a0) returned 1 [0141.312] CloseHandle (hObject=0x188) returned 1 [0141.312] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0141.313] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0141.313] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0141.313] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0141.313] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0141.313] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll")) returned 1 [0141.322] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adal.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\adal.dll")) returned 0xffffffff [0141.322] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.322] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\adm\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0141.324] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.324] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.324] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.324] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.324] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0141.324] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.324] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\af\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0141.326] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.326] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.326] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.326] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0141.326] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.327] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0141.327] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0141.328] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ce [0141.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0141.328] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0141.335] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0141.381] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x2ce, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x2ce, lpOverlapped=0x0) returned 1 [0141.394] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x2d0, lpOverlapped=0x0) returned 1 [0141.395] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0141.410] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0141.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.421] CloseHandle (hObject=0x188) returned 1 [0141.421] CloseHandle (hObject=0x1a0) returned 1 [0141.421] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0141.421] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0141.421] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0141.422] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0141.422] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0141.422] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png")) returned 1 [0141.423] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\alertIcon.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\alerticon.png")) returned 0xffffffff [0141.423] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.423] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\am-et\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0141.423] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.423] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.423] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.423] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0141.423] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.423] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0141.424] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.424] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.424] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0141.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0141.428] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296c8 [0141.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0141.428] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0141.435] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0141.479] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x296c8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x296c8, lpOverlapped=0x0) returned 1 [0141.502] WriteFile (in: hFile=0x190, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x296d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x296d0, lpOverlapped=0x0) returned 1 [0141.504] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0141.519] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0141.523] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.530] CloseHandle (hObject=0x188) returned 1 [0141.530] CloseHandle (hObject=0x190) returned 1 [0141.530] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0141.531] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0141.531] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0141.531] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0141.531] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0141.531] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll")) returned 1 [0141.533] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileCoAuthLib64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filecoauthlib64.dll")) returned 0xffffffff [0141.533] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.533] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0141.533] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0141.533] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfeec8 [0141.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0141.534] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0141.541] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0141.583] ReadFile (in: hFile=0x190, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0xfeec8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0xfeec8, lpOverlapped=0x0) returned 1 [0141.614] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0xfeed0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0xfeed0, lpOverlapped=0x0) returned 1 [0141.626] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0141.642] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0141.646] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.653] CloseHandle (hObject=0x190) returned 1 [0141.653] CloseHandle (hObject=0x188) returned 1 [0141.653] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0141.654] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0141.654] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0141.654] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0141.654] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0141.654] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll")) returned 1 [0141.661] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncapi64.dll")) returned 0xffffffff [0141.661] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0141.661] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0141.661] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0141.664] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2bb2d0 [0141.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0141.664] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0141.671] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0141.722] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x2bb2d0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x2bb2d0, lpOverlapped=0x0) returned 1 [0141.878] WriteFile (in: hFile=0x190, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x2bb2e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x2bb2e0, lpOverlapped=0x0) returned 1 [0141.929] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0141.948] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0141.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.959] CloseHandle (hObject=0x188) returned 1 [0141.959] CloseHandle (hObject=0x190) returned 1 [0141.959] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0141.960] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0141.960] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0141.960] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0141.960] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0141.960] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll")) returned 0 [0141.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\amd64\\filesyncshell64.dll")) returned 0x20 [0141.966] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0141.966] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0141.966] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0141.967] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0141.967] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0141.968] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0141.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0141.968] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0141.975] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.089] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0142.105] WriteFile (in: hFile=0x190, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0142.105] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.121] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.125] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.131] CloseHandle (hObject=0x1a0) returned 1 [0142.131] CloseHandle (hObject=0x190) returned 1 [0142.132] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.132] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.133] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0142.133] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.133] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0142.133] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll")) returned 1 [0142.134] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-console-l1-1-0.dll")) returned 0xffffffff [0142.134] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.134] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.134] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.136] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.136] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.143] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.185] ReadFile (in: hFile=0x190, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.203] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.204] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.220] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.224] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.232] CloseHandle (hObject=0x190) returned 1 [0142.232] CloseHandle (hObject=0x1a0) returned 1 [0142.232] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.233] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.233] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0142.233] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.233] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0142.233] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll")) returned 1 [0142.234] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-datetime-l1-1-0.dll")) returned 0xffffffff [0142.234] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.234] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.234] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.235] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.235] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.242] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.346] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.347] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.348] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.363] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.367] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.374] CloseHandle (hObject=0x1a0) returned 1 [0142.374] CloseHandle (hObject=0x190) returned 1 [0142.374] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.375] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.375] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0142.375] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.375] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0142.375] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll")) returned 1 [0142.376] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-debug-l1-1-0.dll")) returned 0xffffffff [0142.376] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.376] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.376] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.377] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.377] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.377] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.385] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.426] ReadFile (in: hFile=0x190, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.440] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.441] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.456] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.459] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.466] CloseHandle (hObject=0x190) returned 1 [0142.466] CloseHandle (hObject=0x1a0) returned 1 [0142.466] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.467] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.467] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0142.467] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.467] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0142.467] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll")) returned 1 [0142.468] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-errorhandling-l1-1-0.dll")) returned 0xffffffff [0142.468] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.468] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.470] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.470] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54d0 [0142.470] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.470] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.479] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.520] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x54d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x54d0, lpOverlapped=0x0) returned 1 [0142.538] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x54e0, lpOverlapped=0x0) returned 1 [0142.539] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.554] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.557] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.564] CloseHandle (hObject=0x1a0) returned 1 [0142.564] CloseHandle (hObject=0x190) returned 1 [0142.564] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.565] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.565] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0142.565] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.565] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0142.565] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll")) returned 1 [0142.566] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-1-0.dll")) returned 0xffffffff [0142.566] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.566] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.566] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.570] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.570] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.577] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.629] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.635] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.636] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.651] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.654] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.661] CloseHandle (hObject=0x190) returned 1 [0142.661] CloseHandle (hObject=0x1a0) returned 1 [0142.661] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.661] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0142.662] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.662] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0142.662] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0142.663] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l1-2-0.dll")) returned 0xffffffff [0142.663] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.665] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.666] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.666] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.666] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.673] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.720] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.728] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.729] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.745] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.749] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.755] CloseHandle (hObject=0x1a0) returned 1 [0142.755] CloseHandle (hObject=0x190) returned 1 [0142.755] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.756] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.756] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0142.756] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.756] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0142.756] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0142.757] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-file-l2-1-0.dll")) returned 0xffffffff [0142.757] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.758] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.758] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.760] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.760] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.767] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.809] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.825] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.840] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.844] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.850] CloseHandle (hObject=0x190) returned 1 [0142.850] CloseHandle (hObject=0x1a0) returned 1 [0142.850] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.851] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.851] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0142.852] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.852] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0142.852] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll")) returned 1 [0142.852] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-handle-l1-1-0.dll")) returned 0xffffffff [0142.853] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.853] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.855] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.855] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0142.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.855] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.863] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0142.905] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0142.922] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0142.923] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0142.938] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0142.942] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.948] CloseHandle (hObject=0x1a0) returned 1 [0142.948] CloseHandle (hObject=0x190) returned 1 [0142.949] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0142.949] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0142.949] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534d00 [0142.949] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0142.950] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0142.950] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll")) returned 1 [0142.950] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-heap-l1-1-0.dll")) returned 0xffffffff [0142.951] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0142.951] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0142.951] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0142.961] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0142.961] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0142.961] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0142.967] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.085] ReadFile (in: hFile=0x190, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0143.095] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0143.096] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.111] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.115] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.123] CloseHandle (hObject=0x190) returned 1 [0143.123] CloseHandle (hObject=0x1a0) returned 1 [0143.123] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.124] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.124] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0143.124] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.124] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0143.124] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll")) returned 1 [0143.125] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-interlocked-l1-1-0.dll")) returned 0xffffffff [0143.125] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.125] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.125] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.126] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0143.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.126] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.133] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.176] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0143.185] WriteFile (in: hFile=0x190, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0143.186] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.201] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.205] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.213] CloseHandle (hObject=0x1a0) returned 1 [0143.213] CloseHandle (hObject=0x190) returned 1 [0143.213] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.214] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.214] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0143.214] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.214] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0143.214] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll")) returned 1 [0143.215] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-libraryloader-l1-1-0.dll")) returned 0xffffffff [0143.215] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.215] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.215] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.216] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50d0 [0143.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.216] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.223] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.266] ReadFile (in: hFile=0x190, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x50d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ecac*=0x50d0, lpOverlapped=0x0) returned 1 [0143.278] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x50e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ecac*=0x50e0, lpOverlapped=0x0) returned 1 [0143.279] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.294] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.297] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.304] CloseHandle (hObject=0x190) returned 1 [0143.304] CloseHandle (hObject=0x1a0) returned 1 [0143.304] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.305] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.306] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0143.306] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.306] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0143.306] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0143.307] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-localization-l1-2-0.dll")) returned 0xffffffff [0143.307] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.307] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.308] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.310] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0143.310] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.310] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.317] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.358] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0143.365] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0143.366] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.381] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.385] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.391] CloseHandle (hObject=0x1a0) returned 1 [0143.391] CloseHandle (hObject=0x190) returned 1 [0143.392] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.392] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.392] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0143.392] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.392] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0143.392] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll")) returned 1 [0143.393] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-memory-l1-1-0.dll")) returned 0xffffffff [0143.393] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.394] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.394] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.394] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0143.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.394] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.408] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.478] ReadFile (in: hFile=0x190, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0143.483] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0143.489] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.504] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.508] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.514] CloseHandle (hObject=0x190) returned 1 [0143.514] CloseHandle (hObject=0x1a0) returned 1 [0143.515] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.515] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.515] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0143.515] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.515] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0143.515] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll")) returned 1 [0143.516] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-namedpipe-l1-1-0.dll")) returned 0xffffffff [0143.516] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.517] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.517] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.517] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad0 [0143.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.518] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.526] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.567] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x4ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0x4ad0, lpOverlapped=0x0) returned 1 [0143.575] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0x4ae0, lpOverlapped=0x0) returned 1 [0143.576] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.592] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.595] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.602] CloseHandle (hObject=0x1a0) returned 1 [0143.602] CloseHandle (hObject=0x190) returned 1 [0143.602] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.603] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.603] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0143.603] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.603] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0143.603] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll")) returned 1 [0143.604] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processenvironment-l1-1-0.dll")) returned 0xffffffff [0143.604] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.604] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.605] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.605] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ed0 [0143.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.605] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.612] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.656] ReadFile (in: hFile=0x190, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x4ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ecac*=0x4ed0, lpOverlapped=0x0) returned 1 [0143.671] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ecac*=0x4ee0, lpOverlapped=0x0) returned 1 [0143.672] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.692] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.696] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.703] CloseHandle (hObject=0x190) returned 1 [0143.703] CloseHandle (hObject=0x1a0) returned 1 [0143.703] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.704] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.704] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0143.704] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.704] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0143.704] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll")) returned 1 [0143.705] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-0.dll")) returned 0xffffffff [0143.705] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.709] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0143.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.709] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.717] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.760] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0143.762] WriteFile (in: hFile=0x190, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0143.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.779] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.790] CloseHandle (hObject=0x1a0) returned 1 [0143.790] CloseHandle (hObject=0x190) returned 1 [0143.790] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.791] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.791] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0143.791] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.791] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0143.791] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0143.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0xffffffff [0143.807] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.807] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.807] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.808] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44d0 [0143.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.808] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.815] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.868] ReadFile (in: hFile=0x190, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x44d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x44d0, lpOverlapped=0x0) returned 1 [0143.890] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x44e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x44e0, lpOverlapped=0x0) returned 1 [0143.891] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0143.910] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0143.926] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.935] CloseHandle (hObject=0x190) returned 1 [0143.935] CloseHandle (hObject=0x1a0) returned 1 [0143.935] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0143.936] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0143.936] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0143.936] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0143.936] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0143.936] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll")) returned 1 [0143.938] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-profile-l1-1-0.dll")) returned 0xffffffff [0143.938] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0143.938] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0143.938] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0143.938] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44c8 [0143.938] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0143.939] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0143.948] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0143.994] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x44c8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x44c8, lpOverlapped=0x0) returned 1 [0144.000] WriteFile (in: hFile=0x190, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x44d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x44d0, lpOverlapped=0x0) returned 1 [0144.000] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.099] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.103] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.109] CloseHandle (hObject=0x1a0) returned 1 [0144.110] CloseHandle (hObject=0x190) returned 1 [0144.110] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.110] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.110] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0144.111] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.111] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0144.111] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll")) returned 1 [0144.112] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-rtlsupport-l1-1-0.dll")) returned 0xffffffff [0144.112] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.124] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.125] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.127] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0144.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.127] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.134] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.176] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0144.182] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0144.183] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.199] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.209] CloseHandle (hObject=0x190) returned 1 [0144.209] CloseHandle (hObject=0x1a0) returned 1 [0144.209] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.210] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.210] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0144.210] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.210] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0144.210] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll")) returned 1 [0144.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-string-l1-1-0.dll")) returned 0xffffffff [0144.211] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.211] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.211] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.212] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ec8 [0144.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.212] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.219] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.269] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x4ec8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x4ec8, lpOverlapped=0x0) returned 1 [0144.272] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x4ed0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x4ed0, lpOverlapped=0x0) returned 1 [0144.273] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.289] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.293] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.300] CloseHandle (hObject=0x1a0) returned 1 [0144.300] CloseHandle (hObject=0x190) returned 1 [0144.300] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.301] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.301] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0144.301] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.301] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0144.301] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll")) returned 1 [0144.302] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-1-0.dll")) returned 0xffffffff [0144.302] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.302] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.303] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.304] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0144.304] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.305] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.311] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.354] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0144.355] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0144.356] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.372] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.375] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.383] CloseHandle (hObject=0x190) returned 1 [0144.383] CloseHandle (hObject=0x1a0) returned 1 [0144.383] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.384] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.384] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0144.384] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.384] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0144.385] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0144.385] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-synch-l1-2-0.dll")) returned 0xffffffff [0144.386] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.386] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.386] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.387] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ac8 [0144.387] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.387] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.393] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.437] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x4ac8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x4ac8, lpOverlapped=0x0) returned 1 [0144.449] WriteFile (in: hFile=0x190, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x4ad0, lpOverlapped=0x0) returned 1 [0144.450] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.466] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.470] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.477] CloseHandle (hObject=0x1a0) returned 1 [0144.477] CloseHandle (hObject=0x190) returned 1 [0144.478] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.478] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0144.479] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.479] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0144.479] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll")) returned 1 [0144.480] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-sysinfo-l1-1-0.dll")) returned 0xffffffff [0144.480] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.481] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.483] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0144.483] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.483] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.490] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.534] ReadFile (in: hFile=0x190, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0144.543] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0144.544] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.559] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.573] CloseHandle (hObject=0x190) returned 1 [0144.573] CloseHandle (hObject=0x1a0) returned 1 [0144.573] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.574] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.574] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0144.574] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.574] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0144.574] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0144.575] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0xffffffff [0144.576] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.576] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.576] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.576] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46d0 [0144.577] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.577] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.584] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.625] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x46d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x46d0, lpOverlapped=0x0) returned 1 [0144.634] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x46e0, lpOverlapped=0x0) returned 1 [0144.635] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.650] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.654] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.660] CloseHandle (hObject=0x1a0) returned 1 [0144.660] CloseHandle (hObject=0x190) returned 1 [0144.660] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0144.663] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.663] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0144.663] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll")) returned 1 [0144.664] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-core-util-l1-1-0.dll")) returned 0xffffffff [0144.664] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.664] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.664] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.664] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad0 [0144.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.665] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.671] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.771] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x4ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x4ad0, lpOverlapped=0x0) returned 1 [0144.781] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x4ae0, lpOverlapped=0x0) returned 1 [0144.782] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.797] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.800] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.808] CloseHandle (hObject=0x190) returned 1 [0144.808] CloseHandle (hObject=0x1a0) returned 1 [0144.808] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.809] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.809] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0144.809] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.809] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0144.809] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0144.810] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0xffffffff [0144.810] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.810] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.810] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.811] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56d0 [0144.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.811] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.864] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x56d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x56d0, lpOverlapped=0x0) returned 1 [0144.872] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x56e0, lpOverlapped=0x0) returned 1 [0144.873] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.888] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.891] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.899] CloseHandle (hObject=0x1a0) returned 1 [0144.899] CloseHandle (hObject=0x190) returned 1 [0144.899] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.900] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.900] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0144.900] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.900] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0144.900] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0144.901] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0xffffffff [0144.901] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.901] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.902] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.904] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0144.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.904] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0144.911] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0144.953] ReadFile (in: hFile=0x190, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0144.962] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0144.963] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0144.979] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0144.982] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.989] CloseHandle (hObject=0x190) returned 1 [0144.989] CloseHandle (hObject=0x1a0) returned 1 [0144.989] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0144.990] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0144.990] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0144.991] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0144.991] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0144.991] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0144.992] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0xffffffff [0144.992] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0144.992] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0144.992] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0144.994] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ed0 [0144.994] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0144.994] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.000] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.123] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x4ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x4ed0, lpOverlapped=0x0) returned 1 [0145.134] WriteFile (in: hFile=0x190, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x4ee0, lpOverlapped=0x0) returned 1 [0145.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.149] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.153] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.159] CloseHandle (hObject=0x1a0) returned 1 [0145.159] CloseHandle (hObject=0x190) returned 1 [0145.160] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.160] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.160] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0145.160] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.161] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0145.161] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0145.163] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0xffffffff [0145.163] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.163] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.163] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.164] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad0 [0145.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.164] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.171] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.215] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x4ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x4ad0, lpOverlapped=0x0) returned 1 [0145.228] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x4ae0, lpOverlapped=0x0) returned 1 [0145.229] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.244] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.247] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.254] CloseHandle (hObject=0x190) returned 1 [0145.254] CloseHandle (hObject=0x1a0) returned 1 [0145.254] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.255] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.255] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0145.256] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.256] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0145.256] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0145.257] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0xffffffff [0145.257] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.257] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.257] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.258] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0145.259] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.259] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.266] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.318] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0145.331] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0145.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.347] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.358] CloseHandle (hObject=0x1a0) returned 1 [0145.358] CloseHandle (hObject=0x190) returned 1 [0145.358] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.358] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.359] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0145.359] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.359] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0145.359] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0145.360] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0xffffffff [0145.360] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.360] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.361] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.362] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70d0 [0145.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.363] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.370] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.411] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x70d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x70d0, lpOverlapped=0x0) returned 1 [0145.493] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x70e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x70e0, lpOverlapped=0x0) returned 1 [0145.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.511] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.515] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.522] CloseHandle (hObject=0x190) returned 1 [0145.522] CloseHandle (hObject=0x1a0) returned 1 [0145.522] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.523] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.523] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0145.523] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.523] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0145.523] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0145.524] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-math-l1-1-0.dll")) returned 0xffffffff [0145.524] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.524] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.524] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.525] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66d0 [0145.525] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.525] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.532] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.574] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x66d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19ecac*=0x66d0, lpOverlapped=0x0) returned 1 [0145.593] WriteFile (in: hFile=0x190, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19ecac*=0x66e0, lpOverlapped=0x0) returned 1 [0145.594] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.615] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.620] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.628] CloseHandle (hObject=0x1a0) returned 1 [0145.628] CloseHandle (hObject=0x190) returned 1 [0145.628] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.629] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.629] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0145.629] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.629] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0145.629] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0145.632] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0xffffffff [0145.632] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.632] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.632] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.633] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11cc8 [0145.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.633] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.640] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.683] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x11cc8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x11cc8, lpOverlapped=0x0) returned 1 [0145.699] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x11cd0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x11cd0, lpOverlapped=0x0) returned 1 [0145.700] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.715] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.719] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.730] CloseHandle (hObject=0x190) returned 1 [0145.730] CloseHandle (hObject=0x1a0) returned 1 [0145.730] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.731] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.731] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0145.731] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.731] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0145.731] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0145.732] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-private-l1-1-0.dll")) returned 0xffffffff [0145.732] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.733] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.733] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.735] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ad0 [0145.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.735] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.743] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.789] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x4ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x4ad0, lpOverlapped=0x0) returned 1 [0145.807] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x4ae0, lpOverlapped=0x0) returned 1 [0145.808] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.823] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.833] CloseHandle (hObject=0x1a0) returned 1 [0145.833] CloseHandle (hObject=0x190) returned 1 [0145.834] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.835] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.835] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0145.835] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.835] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0145.835] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0145.836] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-process-l1-1-0.dll")) returned 0xffffffff [0145.836] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.836] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.838] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.839] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58d0 [0145.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.840] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.846] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.889] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x58d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x58d0, lpOverlapped=0x0) returned 1 [0145.898] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x58e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x58e0, lpOverlapped=0x0) returned 1 [0145.899] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0145.916] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0145.920] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.926] CloseHandle (hObject=0x190) returned 1 [0145.927] CloseHandle (hObject=0x1a0) returned 1 [0145.927] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0145.928] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0145.928] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0145.928] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0145.928] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0145.929] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0145.929] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0xffffffff [0145.930] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0145.930] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0145.930] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0145.933] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ed0 [0145.933] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0145.933] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0145.940] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0145.987] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x5ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x5ed0, lpOverlapped=0x0) returned 1 [0145.994] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x5ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x5ee0, lpOverlapped=0x0) returned 1 [0145.995] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.090] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.094] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.103] CloseHandle (hObject=0x1a0) returned 1 [0146.103] CloseHandle (hObject=0x190) returned 1 [0146.103] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.104] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.104] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0146.104] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.104] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0146.104] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0146.105] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0xffffffff [0146.105] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.106] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.106] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.107] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ed0 [0146.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.107] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.114] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.155] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x5ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x5ed0, lpOverlapped=0x0) returned 1 [0146.168] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x5ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x5ee0, lpOverlapped=0x0) returned 1 [0146.169] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.184] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.188] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.195] CloseHandle (hObject=0x190) returned 1 [0146.195] CloseHandle (hObject=0x1a0) returned 1 [0146.195] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.196] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.196] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0146.196] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.196] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0146.196] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0146.197] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-string-l1-1-0.dll")) returned 0xffffffff [0146.197] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.197] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.198] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.198] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50d0 [0146.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.198] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.205] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.247] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x50d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x50d0, lpOverlapped=0x0) returned 1 [0146.249] WriteFile (in: hFile=0x190, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x50e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x50e0, lpOverlapped=0x0) returned 1 [0146.250] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.264] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.268] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.275] CloseHandle (hObject=0x1a0) returned 1 [0146.275] CloseHandle (hObject=0x190) returned 1 [0146.275] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.275] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.276] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0146.276] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.276] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0146.276] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0146.277] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-time-l1-1-0.dll")) returned 0xffffffff [0146.277] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.277] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.279] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.280] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48d0 [0146.280] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.280] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.287] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.328] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x48d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x48d0, lpOverlapped=0x0) returned 1 [0146.330] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x48e0, lpOverlapped=0x0) returned 1 [0146.331] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.346] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.349] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.356] CloseHandle (hObject=0x190) returned 1 [0146.356] CloseHandle (hObject=0x1a0) returned 1 [0146.356] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.357] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.357] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0146.357] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.357] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0146.357] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0146.358] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0xffffffff [0146.358] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.358] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.358] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.360] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x157b [0146.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.360] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.367] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.411] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x157b, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x157b, lpOverlapped=0x0) returned 1 [0146.431] WriteFile (in: hFile=0x190, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x1580, lpOverlapped=0x0) returned 1 [0146.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.447] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.451] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.459] CloseHandle (hObject=0x1a0) returned 1 [0146.460] CloseHandle (hObject=0x190) returned 1 [0146.460] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.460] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.460] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0146.461] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.461] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0146.461] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png")) returned 1 [0146.464] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appblue.png")) returned 0xffffffff [0146.464] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.464] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.464] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.465] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d96 [0146.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.465] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.472] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.514] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x1d96, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x1d96, lpOverlapped=0x0) returned 1 [0146.516] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x1da0, lpOverlapped=0x0) returned 1 [0146.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.532] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.536] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.543] CloseHandle (hObject=0x190) returned 1 [0146.543] CloseHandle (hObject=0x1a0) returned 1 [0146.543] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.543] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.543] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0146.544] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.544] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0146.544] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png")) returned 1 [0146.545] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorblue.png")) returned 0xffffffff [0146.545] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.546] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2062 [0146.546] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.546] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.553] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.596] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x2062, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x2062, lpOverlapped=0x0) returned 1 [0146.608] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x2070, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x2070, lpOverlapped=0x0) returned 1 [0146.609] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.624] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.627] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.634] CloseHandle (hObject=0x1a0) returned 1 [0146.634] CloseHandle (hObject=0x190) returned 1 [0146.635] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.635] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.635] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0146.636] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.636] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0146.636] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png")) returned 1 [0146.637] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppErrorWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\apperrorwhite.png")) returned 0xffffffff [0146.637] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.638] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.639] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbeb [0146.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.639] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.647] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.689] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0xbeb, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0xbeb, lpOverlapped=0x0) returned 1 [0146.700] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0xbf0, lpOverlapped=0x0) returned 1 [0146.701] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.719] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.723] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.729] CloseHandle (hObject=0x190) returned 1 [0146.729] CloseHandle (hObject=0x1a0) returned 1 [0146.729] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.730] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.730] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535400 [0146.730] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.730] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0146.730] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png")) returned 1 [0146.731] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\appwhite.png")) returned 0xffffffff [0146.731] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.731] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ar\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0146.731] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.731] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.732] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.732] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0146.732] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.734] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\as-in\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0146.734] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.734] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.735] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.735] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0146.735] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.735] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.735] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.737] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d8f6 [0146.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.737] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.744] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.786] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x5d8f6, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x5d8f6, lpOverlapped=0x0) returned 1 [0146.821] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x5d900, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x5d900, lpOverlapped=0x0) returned 1 [0146.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.842] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.846] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.852] CloseHandle (hObject=0x1a0) returned 1 [0146.853] CloseHandle (hObject=0x190) returned 1 [0146.853] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.853] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.853] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0146.854] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.854] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0146.854] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif")) returned 1 [0146.857] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.gif")) returned 0xffffffff [0146.857] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.857] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.857] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.858] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27f2 [0146.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.858] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.865] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0146.912] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x27f2, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x27f2, lpOverlapped=0x0) returned 1 [0146.924] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x2800, lpOverlapped=0x0) returned 1 [0146.925] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0146.942] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0146.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.953] CloseHandle (hObject=0x190) returned 1 [0146.953] CloseHandle (hObject=0x1a0) returned 1 [0146.953] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0146.954] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0146.954] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0146.954] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0146.954] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0146.954] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png")) returned 1 [0146.955] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\AutoPlayOptIn.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\autoplayoptin.png")) returned 0xffffffff [0146.955] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.955] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\az-latn-az\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0146.955] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.955] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.956] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.956] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0146.956] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.956] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\be\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0146.960] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.961] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.961] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.961] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0146.961] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.961] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\bg\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0146.963] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.963] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.963] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.963] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0146.963] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.963] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\bn-bd\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0146.963] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.963] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.964] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.964] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0146.964] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.964] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\bn-in\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0146.966] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.966] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.967] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.967] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0146.967] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\bs-latn-ba\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0146.969] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.969] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.969] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.969] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0146.969] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.969] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ca\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0146.972] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.972] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.972] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.972] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0146.972] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.972] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ca-es-valencia\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0146.973] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.973] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0146.973] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0146.973] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0146.973] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0146.974] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0146.974] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0146.978] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1914 [0146.978] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0146.979] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0146.985] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.119] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x1914, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x1914, lpOverlapped=0x0) returned 1 [0147.133] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x1920, lpOverlapped=0x0) returned 1 [0147.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.155] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.159] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.165] CloseHandle (hObject=0x1a0) returned 1 [0147.166] CloseHandle (hObject=0x190) returned 1 [0147.166] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.167] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.167] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0147.167] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.167] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0147.167] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat")) returned 1 [0147.168] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\CollectSyncLogs.bat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\collectsynclogs.bat")) returned 0xffffffff [0147.168] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.168] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\cs\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0147.175] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.175] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.175] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.175] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0147.175] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.175] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\cy-gb\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0147.177] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.177] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.178] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.178] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0147.178] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.178] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\da\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0147.179] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.179] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.180] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.180] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0147.180] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.180] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\de\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0147.182] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.182] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.183] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.183] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0147.183] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.183] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\el\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0147.190] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.190] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.191] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.191] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0147.191] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.191] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.193] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.193] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cd7 [0147.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.194] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.200] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.243] ReadFile (in: hFile=0x190, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x1cd7, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x1cd7, lpOverlapped=0x0) returned 1 [0147.263] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x1ce0, lpOverlapped=0x0) returned 1 [0147.263] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.278] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.282] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.288] CloseHandle (hObject=0x190) returned 1 [0147.288] CloseHandle (hObject=0x1a0) returned 1 [0147.289] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.289] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.289] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0147.289] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.290] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0147.290] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png")) returned 1 [0147.290] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppBlue.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappblue.png")) returned 0xffffffff [0147.291] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.291] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.291] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.294] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13cc [0147.294] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.295] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.301] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.342] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x13cc, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x13cc, lpOverlapped=0x0) returned 1 [0147.350] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x13d0, lpOverlapped=0x0) returned 1 [0147.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.365] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.369] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.376] CloseHandle (hObject=0x1a0) returned 1 [0147.376] CloseHandle (hObject=0x190) returned 1 [0147.376] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.377] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.377] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0147.377] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.377] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0147.377] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png")) returned 1 [0147.378] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ElevatedAppWhite.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\elevatedappwhite.png")) returned 0xffffffff [0147.378] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.378] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\en\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0147.379] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.380] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.380] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.380] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0147.380] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.380] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\en-gb\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0147.382] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.382] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.382] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.382] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0147.382] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.383] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.383] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.383] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e64 [0147.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.384] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.390] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.436] ReadFile (in: hFile=0x190, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1e64, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ecac*=0x1e64, lpOverlapped=0x0) returned 1 [0147.447] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ecac*=0x1e70, lpOverlapped=0x0) returned 1 [0147.448] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.464] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.467] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.474] CloseHandle (hObject=0x190) returned 1 [0147.474] CloseHandle (hObject=0x1a0) returned 1 [0147.474] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.475] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.475] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0147.475] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.475] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0147.475] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png")) returned 1 [0147.476] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Error.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\error.png")) returned 0xffffffff [0147.476] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.476] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.476] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.479] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13c4 [0147.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.479] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.486] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.529] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x13c4, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x13c4, lpOverlapped=0x0) returned 1 [0147.531] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x13d0, lpOverlapped=0x0) returned 1 [0147.532] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.546] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.550] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.557] CloseHandle (hObject=0x1a0) returned 1 [0147.557] CloseHandle (hObject=0x190) returned 1 [0147.557] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.558] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.558] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0147.558] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.558] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0147.558] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html")) returned 1 [0147.559] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ErrorPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\errorpage.html")) returned 0xffffffff [0147.559] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.559] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\es\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0147.561] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.561] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.561] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.561] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0147.561] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.561] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\et\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0147.563] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.563] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.563] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.563] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0147.563] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.564] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.565] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.566] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x78d0 [0147.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.566] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.575] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.622] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x78d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x78d0, lpOverlapped=0x0) returned 1 [0147.623] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x78e0, lpOverlapped=0x0) returned 1 [0147.625] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.642] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.645] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.652] CloseHandle (hObject=0x190) returned 1 [0147.652] CloseHandle (hObject=0x1a0) returned 1 [0147.652] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.653] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.653] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0147.653] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.653] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0147.653] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll")) returned 1 [0147.654] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ETWlog.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\etwlog.dll")) returned 0xffffffff [0147.654] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.654] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\eu\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0147.655] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.655] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.656] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.656] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0147.656] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.656] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\fa\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0147.658] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.658] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.658] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.658] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0147.658] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.659] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\fi\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0147.660] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.660] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.661] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.661] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0147.661] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\fil-ph\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0147.662] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.662] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0147.663] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0147.663] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0147.663] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.663] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.664] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.665] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x262d0 [0147.666] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.666] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.672] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.723] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x262d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x262d0, lpOverlapped=0x0) returned 1 [0147.727] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x262e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x262e0, lpOverlapped=0x0) returned 1 [0147.729] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.745] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.748] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.756] CloseHandle (hObject=0x1a0) returned 1 [0147.756] CloseHandle (hObject=0x190) returned 1 [0147.756] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.757] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.757] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0147.757] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.757] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0147.757] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll")) returned 1 [0147.758] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileCoAuthLib.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filecoauthlib.dll")) returned 0xffffffff [0147.758] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.759] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.759] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.759] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f6d0 [0147.759] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.759] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.766] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.808] ReadFile (in: hFile=0x190, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x1f6d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ecac*=0x1f6d0, lpOverlapped=0x0) returned 1 [0147.818] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x1f6e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ecac*=0x1f6e0, lpOverlapped=0x0) returned 1 [0147.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.836] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.840] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.846] CloseHandle (hObject=0x190) returned 1 [0147.846] CloseHandle (hObject=0x1a0) returned 1 [0147.847] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.847] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.847] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0147.847] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.847] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0147.847] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll")) returned 1 [0147.849] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.localizedresources.dll")) returned 0xffffffff [0147.849] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.849] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.850] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.851] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab4d0 [0147.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.851] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.858] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0147.904] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0xab4d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ecac*=0xab4d0, lpOverlapped=0x0) returned 1 [0147.930] WriteFile (in: hFile=0x190, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0xab4e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0xab4e0, lpOverlapped=0x0) returned 1 [0147.938] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0147.957] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0147.961] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.968] CloseHandle (hObject=0x1a0) returned 1 [0147.968] CloseHandle (hObject=0x190) returned 1 [0147.968] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0147.968] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0147.969] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0147.969] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0147.969] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0147.969] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll")) returned 1 [0147.973] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSync.Resources.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesync.resources.dll")) returned 0xffffffff [0147.974] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0147.974] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0147.974] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0147.975] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xba0d0 [0147.975] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0147.975] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0147.982] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0148.123] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0xba0d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0xba0d0, lpOverlapped=0x0) returned 1 [0148.162] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0xba0e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0xba0e0, lpOverlapped=0x0) returned 1 [0148.170] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0148.185] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0148.189] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.200] CloseHandle (hObject=0x190) returned 1 [0148.200] CloseHandle (hObject=0x1a0) returned 1 [0148.201] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0148.201] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0148.201] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0148.202] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0148.202] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0148.202] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll")) returned 1 [0148.207] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncapi.dll")) returned 0xffffffff [0148.207] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0148.209] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0148.210] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0148.210] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f6ad0 [0148.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0148.211] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0148.217] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0148.278] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x2f6ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x2f6ad0, lpOverlapped=0x0) returned 1 [0148.393] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x2f6ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x2f6ae0, lpOverlapped=0x0) returned 1 [0148.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0148.448] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0148.452] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.460] CloseHandle (hObject=0x1a0) returned 1 [0148.460] CloseHandle (hObject=0x190) returned 1 [0148.460] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0148.461] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0148.461] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0148.461] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0148.461] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0148.461] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll")) returned 1 [0148.467] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncClient.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncclient.dll")) returned 0xffffffff [0148.467] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0148.468] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0148.468] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0148.470] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0148.470] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120d0 [0148.470] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0148.471] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0148.478] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0148.524] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x120d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x120d0, lpOverlapped=0x0) returned 1 [0148.562] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x120e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x120e0, lpOverlapped=0x0) returned 1 [0148.563] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0148.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0148.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.588] CloseHandle (hObject=0x190) returned 1 [0148.588] CloseHandle (hObject=0x1a0) returned 1 [0148.588] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0148.589] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0148.589] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0148.589] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0148.589] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0148.589] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll")) returned 1 [0148.590] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFAL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfal.dll")) returned 0xffffffff [0148.591] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0148.591] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0148.591] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0148.592] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33ad0 [0148.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0148.592] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0148.600] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0148.640] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x33ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x33ad0, lpOverlapped=0x0) returned 1 [0148.663] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x33ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x33ae0, lpOverlapped=0x0) returned 1 [0148.666] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0148.681] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0148.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.690] CloseHandle (hObject=0x1a0) returned 1 [0148.691] CloseHandle (hObject=0x190) returned 1 [0148.691] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0148.692] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0148.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0148.692] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0148.692] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0148.692] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll")) returned 1 [0148.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncFALWB.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncfalwb.dll")) returned 0xffffffff [0148.703] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0148.704] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0148.705] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0148.706] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176ed0 [0148.706] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0148.706] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0148.713] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0148.757] ReadFile (in: hFile=0x190, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x176ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x176ed0, lpOverlapped=0x0) returned 1 [0148.826] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x176ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x176ee0, lpOverlapped=0x0) returned 1 [0148.856] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0148.871] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0148.875] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.882] CloseHandle (hObject=0x190) returned 1 [0148.882] CloseHandle (hObject=0x1a0) returned 1 [0148.883] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0148.883] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0148.883] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0148.883] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0148.883] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0148.883] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll")) returned 1 [0148.887] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncSessions.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncsessions.dll")) returned 0xffffffff [0148.887] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0148.887] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0148.887] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0148.889] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27b6d0 [0148.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0148.889] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0148.896] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0148.942] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x27b6d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x27b6d0, lpOverlapped=0x0) returned 1 [0149.031] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x27b6e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x27b6e0, lpOverlapped=0x0) returned 1 [0149.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0149.147] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0149.150] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.156] CloseHandle (hObject=0x1a0) returned 1 [0149.157] CloseHandle (hObject=0x190) returned 1 [0149.157] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0149.157] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0149.157] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0149.158] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0149.158] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0149.158] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll")) returned 1 [0149.161] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncShell.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncshell.dll")) returned 0xffffffff [0149.161] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.162] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0149.163] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0149.165] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc36c8 [0149.165] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0149.166] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0149.172] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0149.219] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0xc36c8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0xc36c8, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0xc36d0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0xc36d0, lpOverlapped=0x0) returned 1 [0149.258] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0149.280] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0149.283] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.290] CloseHandle (hObject=0x190) returned 1 [0149.290] CloseHandle (hObject=0x1a0) returned 1 [0149.290] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0149.291] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0149.291] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0149.291] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0149.291] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.291] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll")) returned 1 [0149.297] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\FileSyncViews.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\filesyncviews.dll")) returned 0xffffffff [0149.297] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.297] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\fr\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0149.299] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.299] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.299] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.299] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0149.299] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.299] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ga-ie\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0149.301] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.301] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.301] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.301] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.301] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.301] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\gd-latn\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0149.303] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.303] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.303] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.303] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0149.303] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.303] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\gl\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0149.306] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.306] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.306] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.306] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0149.306] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.306] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\gu\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0149.306] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.306] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.307] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.307] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0149.307] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.307] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ha-latn-ng\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0149.307] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.307] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.308] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.308] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0149.308] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.308] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\he\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0149.308] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.308] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.309] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.309] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0149.309] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.309] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\hi\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0149.311] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.311] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.312] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.312] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0149.312] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.312] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\hr\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0149.312] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.312] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.313] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.313] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0149.313] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.313] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\hu\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0149.314] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.314] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.315] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.315] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0149.315] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\hy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0149.317] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.317] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.317] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.317] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0149.317] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.317] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\id\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0149.319] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.319] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.320] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.320] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.320] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.320] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ig-ng\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0149.322] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.322] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.322] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.322] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0149.323] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.323] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0149.330] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.330] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.330] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0149.330] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0149.331] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f4d0 [0149.331] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0149.331] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0149.338] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0149.382] ReadFile (in: hFile=0x190, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x3f4d0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x3f4d0, lpOverlapped=0x0) returned 1 [0149.396] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x3f4e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x3f4e0, lpOverlapped=0x0) returned 1 [0149.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0149.414] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0149.418] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.425] CloseHandle (hObject=0x190) returned 1 [0149.425] CloseHandle (hObject=0x188) returned 1 [0149.425] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0149.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0149.426] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0149.426] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0149.426] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0149.426] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll")) returned 1 [0149.428] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qjpeg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qjpeg.dll")) returned 0xffffffff [0149.428] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.428] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0149.430] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0149.441] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ed0 [0149.441] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0149.441] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0149.448] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0149.491] ReadFile (in: hFile=0x188, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x8ed0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ea44*=0x8ed0, lpOverlapped=0x0) returned 1 [0149.498] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x8ee0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ea44*=0x8ee0, lpOverlapped=0x0) returned 1 [0149.499] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0149.518] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0149.523] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.530] CloseHandle (hObject=0x188) returned 1 [0149.530] CloseHandle (hObject=0x190) returned 1 [0149.530] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0149.531] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0149.531] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0149.531] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0149.531] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.531] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll")) returned 1 [0149.532] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\imageformats\\qsvg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\imageformats\\qsvg.dll")) returned 0xffffffff [0149.532] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.532] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0149.533] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.533] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0149.536] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.539] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.540] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.540] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0149.541] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0149.542] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x321 [0149.542] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0149.542] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0149.550] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0149.613] ReadFile (in: hFile=0x190, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x321, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ea44*=0x321, lpOverlapped=0x0) returned 1 [0149.627] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ea44*=0x330, lpOverlapped=0x0) returned 1 [0149.627] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0149.645] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0149.649] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.721] CloseHandle (hObject=0x190) returned 1 [0149.721] CloseHandle (hObject=0x188) returned 1 [0149.736] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0149.737] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0149.737] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0149.737] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0149.737] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0149.737] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png")) returned 1 [0149.738] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\images\\blurrect.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\images\\blurrect.png")) returned 0xffffffff [0149.738] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.738] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.739] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.739] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.740] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.741] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.742] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.742] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.743] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.743] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.743] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.744] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.744] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.745] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.745] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.746] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.746] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.746] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.747] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.747] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.748] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.748] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.749] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.749] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.750] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.750] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.750] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.751] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.751] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0149.751] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.751] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\is\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0149.751] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.751] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.752] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.752] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0149.752] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.752] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\it\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0149.752] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.752] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.752] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.752] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0149.752] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.752] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ja\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0149.753] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.753] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.753] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.753] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0149.753] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.753] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ka\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0149.755] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.756] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.756] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.756] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0149.756] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.756] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\kk\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0149.757] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.757] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.757] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.757] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0149.757] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.757] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\km-kh\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0149.758] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.758] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.759] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.759] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.759] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.759] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\kn\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0149.759] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.759] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.760] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.760] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.760] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.760] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ko\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0149.760] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.760] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.760] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.760] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0149.760] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.760] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\kok\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0149.761] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.761] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.761] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.761] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0149.761] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.761] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ku-arab\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0149.761] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.761] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.762] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.762] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.762] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.762] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ky\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0149.762] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.762] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.764] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.764] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.764] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.764] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\lb-lu\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0149.764] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.764] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0149.764] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0149.764] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0149.764] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.765] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0149.765] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0149.765] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a0d0 [0149.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0149.766] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0149.776] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0149.836] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x13a0d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x13a0d0, lpOverlapped=0x0) returned 1 [0149.914] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x13a0e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x13a0e0, lpOverlapped=0x0) returned 1 [0149.934] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0149.949] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0149.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.961] CloseHandle (hObject=0x1a0) returned 1 [0149.961] CloseHandle (hObject=0x188) returned 1 [0149.962] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0149.963] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0149.963] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0149.963] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0149.963] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0149.963] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll")) returned 1 [0149.965] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libeay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libeay32.dll")) returned 0xffffffff [0149.965] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0149.965] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0149.965] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0149.966] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74d0 [0149.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0149.966] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0149.976] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0150.025] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x74d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x74d0, lpOverlapped=0x0) returned 1 [0150.042] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x74e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x74e0, lpOverlapped=0x0) returned 1 [0150.043] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0150.059] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0150.128] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.134] CloseHandle (hObject=0x188) returned 1 [0150.134] CloseHandle (hObject=0x1a0) returned 1 [0150.134] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0150.135] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0150.135] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0150.135] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0150.135] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0150.135] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll")) returned 1 [0150.136] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libEGL.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libegl.dll")) returned 0xffffffff [0150.136] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.139] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0150.139] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0150.140] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e06d0 [0150.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0150.141] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0150.147] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0150.190] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x1e06d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x1e06d0, lpOverlapped=0x0) returned 1 [0150.330] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x1e06e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x1e06e0, lpOverlapped=0x0) returned 1 [0150.355] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0150.370] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0150.374] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.382] CloseHandle (hObject=0x1a0) returned 1 [0150.382] CloseHandle (hObject=0x188) returned 1 [0150.383] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0150.384] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0150.384] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534cc0 [0150.384] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0150.384] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0150.384] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll")) returned 1 [0150.391] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\libGLESv2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\libglesv2.dll")) returned 0xffffffff [0150.391] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.391] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0150.392] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0150.392] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1900 [0150.392] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0150.392] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0150.399] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0150.448] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x1900, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x1900, lpOverlapped=0x0) returned 1 [0150.449] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x1910, lpOverlapped=0x0) returned 1 [0150.450] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0150.465] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0150.471] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.477] CloseHandle (hObject=0x188) returned 1 [0150.477] CloseHandle (hObject=0x1a0) returned 1 [0150.478] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0150.478] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0150.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0150.478] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0150.478] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0150.479] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html")) returned 1 [0150.479] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoadingPage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loadingpage.html")) returned 0xffffffff [0150.479] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0150.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0150.480] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14e6d0 [0150.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0150.481] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0150.488] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0150.531] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x14e6d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x14e6d0, lpOverlapped=0x0) returned 1 [0150.805] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x14e6e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x14e6e0, lpOverlapped=0x0) returned 1 [0150.824] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0150.839] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0150.842] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.850] CloseHandle (hObject=0x1a0) returned 1 [0150.850] CloseHandle (hObject=0x188) returned 1 [0150.850] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0150.851] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0150.851] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0150.851] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0150.851] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0150.851] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll")) returned 1 [0150.860] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\LoggingPlatform.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\loggingplatform.dll")) returned 0xffffffff [0150.860] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.860] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\lt\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0150.860] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.860] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.861] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.861] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0150.861] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.861] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\lv\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0150.861] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.862] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.862] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.862] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0150.863] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.863] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\mi-nz\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0150.863] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.863] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.863] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.863] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0150.863] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.863] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\mk\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0150.863] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.864] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.864] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.864] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0150.864] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.864] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ml-in\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0150.864] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.864] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.865] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.865] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0150.865] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.865] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\mn\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0150.865] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.865] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.866] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.866] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0150.866] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.866] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\mr\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0150.867] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.867] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.868] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.868] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0150.868] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.868] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ms\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0150.872] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.872] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0150.872] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0150.873] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0150.873] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0150.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0150.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0150.873] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6acd0 [0150.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0150.874] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0150.881] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0150.922] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x6acd0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x6acd0, lpOverlapped=0x0) returned 1 [0151.000] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x6ace0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x6ace0, lpOverlapped=0x0) returned 1 [0151.005] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0151.021] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0151.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.035] CloseHandle (hObject=0x188) returned 1 [0151.035] CloseHandle (hObject=0x1a0) returned 1 [0151.035] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0151.036] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0151.036] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0151.036] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0151.036] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0151.036] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll")) returned 1 [0151.039] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\msvcp140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\msvcp140.dll")) returned 0xffffffff [0151.039] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.039] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\mt-mt\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0151.040] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.040] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.040] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.040] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0151.040] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.040] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\nb-no\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0151.042] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.042] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.042] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.042] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0151.042] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.043] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ne-np\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0151.043] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.043] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.043] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.043] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0151.043] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.043] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\nl\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0151.044] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.044] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.044] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.044] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0151.044] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.044] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\nn-no\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0151.047] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.047] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.047] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.047] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0151.047] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.047] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\nso-za\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0151.048] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.048] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.048] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.048] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0151.048] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.049] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0151.049] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0151.049] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123c [0151.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0151.050] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0151.057] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0151.159] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x123c, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x123c, lpOverlapped=0x0) returned 1 [0151.160] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x1240, lpOverlapped=0x0) returned 1 [0151.161] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0151.177] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0151.181] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.188] CloseHandle (hObject=0x1a0) returned 1 [0151.188] CloseHandle (hObject=0x188) returned 1 [0151.188] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0151.189] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0151.189] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0151.189] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0151.189] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0151.189] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png")) returned 1 [0151.190] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\OneDriveLogo.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\onedrivelogo.png")) returned 0xffffffff [0151.190] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.191] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.191] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\or-in\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0151.192] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.192] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.193] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.193] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0151.193] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.193] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\pa\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0151.193] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.193] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.193] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.193] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0151.193] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.193] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\pa-arab\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0151.195] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.195] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.196] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.196] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0151.196] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.196] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\pl\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0151.196] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.196] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.196] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.197] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0151.197] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.197] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0151.198] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.198] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.198] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0151.198] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0151.199] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c4d0 [0151.199] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0151.199] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0151.206] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0151.250] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x10c4d0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x10c4d0, lpOverlapped=0x0) returned 1 [0151.384] WriteFile (in: hFile=0x190, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x10c4e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x10c4e0, lpOverlapped=0x0) returned 1 [0151.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0151.414] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0151.418] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.424] CloseHandle (hObject=0x1a0) returned 1 [0151.424] CloseHandle (hObject=0x190) returned 1 [0151.425] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0151.425] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0151.425] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0151.425] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0151.425] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0151.425] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll")) returned 1 [0151.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\platforms\\qwindows.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\platforms\\qwindows.dll")) returned 0xffffffff [0151.427] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.427] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0151.427] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.427] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\prs-af\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0151.427] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.427] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.427] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.427] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0151.427] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.427] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\pt-br\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0151.429] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.429] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.429] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.429] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0151.429] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.429] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\pt-pt\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0151.429] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.429] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.430] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0151.430] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0151.430] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0151.430] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0151.431] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.431] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.432] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0151.432] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535200 [0151.442] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0151.442] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0151.442] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534c80 [0151.442] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.443] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.443] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x534ec0 [0151.443] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0151.443] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0151.443] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535240 [0151.443] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0151.443] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0151.443] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0151.443] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b0 [0151.444] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1ac [0151.444] GetFileSize (in: hFile=0x1b0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb6d0 [0151.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0151.444] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0151.451] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0151.497] ReadFile (in: hFile=0x1b0, lpBuffer=0x1d470b0, nNumberOfBytesToRead=0xcb6d0, lpNumberOfBytesRead=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesRead=0x19e0a4*=0xcb6d0, lpOverlapped=0x0) returned 1 [0151.671] WriteFile (in: hFile=0x1ac, lpBuffer=0x1d470b0*, nNumberOfBytesToWrite=0xcb6e0, lpNumberOfBytesWritten=0x19e0a4, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesWritten=0x19e0a4*=0xcb6e0, lpOverlapped=0x0) returned 1 [0151.680] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0151.695] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0151.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.706] CloseHandle (hObject=0x1b0) returned 1 [0151.706] CloseHandle (hObject=0x1ac) returned 1 [0151.706] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0151.707] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0151.707] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535400 [0151.707] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0 [0151.707] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0151.707] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll")) returned 1 [0151.713] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls\\Styles\\Flat\\qtquickextrasflatplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls\\styles\\flat\\qtquickextrasflatplugin.dll")) returned 0xffffffff [0151.713] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0151.713] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0151.713] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0151.713] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0151.713] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0151.713] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0151.713] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0151.714] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0151.714] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535380 [0151.722] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.722] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.723] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.723] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.723] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.724] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.724] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.725] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.725] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0151.726] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0151.726] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x162d0 [0151.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0151.726] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0151.733] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0151.777] ReadFile (in: hFile=0x198, lpBuffer=0x1d470a4, nNumberOfBytesToRead=0x162d0, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesRead=0x19e574*=0x162d0, lpOverlapped=0x0) returned 1 [0151.808] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470a4*, nNumberOfBytesToWrite=0x162e0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesWritten=0x19e574*=0x162e0, lpOverlapped=0x0) returned 1 [0151.809] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0151.824] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0151.829] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.836] CloseHandle (hObject=0x198) returned 1 [0151.836] CloseHandle (hObject=0x1a4) returned 1 [0151.836] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0151.837] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0151.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0151.837] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0151.837] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0151.837] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll")) returned 1 [0151.838] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Controls.2\\qtquickcontrols2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\controls.2\\qtquickcontrols2plugin.dll")) returned 0xffffffff [0151.838] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.839] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.839] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0151.839] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0151.839] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0151.839] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534e40 [0151.840] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.840] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.841] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.841] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.841] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0151.842] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0151.883] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122d0 [0151.883] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0151.883] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0151.890] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0151.932] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x122d0, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19e574*=0x122d0, lpOverlapped=0x0) returned 1 [0151.962] WriteFile (in: hFile=0x198, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x122e0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19e574*=0x122e0, lpOverlapped=0x0) returned 1 [0151.963] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0151.978] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0151.981] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.988] CloseHandle (hObject=0x1a4) returned 1 [0151.988] CloseHandle (hObject=0x198) returned 1 [0151.989] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0151.989] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0151.989] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534e80 [0151.990] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0151.990] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0151.990] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll")) returned 1 [0151.991] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Extras\\qtquickextrasplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\extras\\qtquickextrasplugin.dll")) returned 0xffffffff [0151.991] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0151.991] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0151.991] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0151.991] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535380 [0151.991] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.991] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.992] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.992] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0151.992] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0151.993] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0152.005] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x154d0 [0152.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0152.005] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0152.011] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0152.054] ReadFile (in: hFile=0x198, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x154d0, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19e574*=0x154d0, lpOverlapped=0x0) returned 1 [0152.127] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x154e0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19e574*=0x154e0, lpOverlapped=0x0) returned 1 [0152.129] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0152.144] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0152.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.155] CloseHandle (hObject=0x198) returned 1 [0152.155] CloseHandle (hObject=0x1a4) returned 1 [0152.155] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0152.156] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0152.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535240 [0152.156] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0152.156] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0152.156] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll")) returned 1 [0152.157] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Layouts\\qquicklayoutsplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\layouts\\qquicklayoutsplugin.dll")) returned 0xffffffff [0152.157] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0152.157] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0152.157] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0152.157] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535380 [0152.191] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.191] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.192] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.192] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.192] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0152.193] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0152.194] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a8d0 [0152.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0152.194] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0152.201] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0152.251] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x3a8d0, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19e574*=0x3a8d0, lpOverlapped=0x0) returned 1 [0152.278] WriteFile (in: hFile=0x198, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x3a8e0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19e574*=0x3a8e0, lpOverlapped=0x0) returned 1 [0152.281] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0152.296] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0152.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.307] CloseHandle (hObject=0x1a4) returned 1 [0152.307] CloseHandle (hObject=0x198) returned 1 [0152.307] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0152.308] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0152.308] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535000 [0152.308] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0152.308] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0152.308] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll")) returned 1 [0152.310] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Templates.2\\qtquicktemplates2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\templates.2\\qtquicktemplates2plugin.dll")) returned 0xffffffff [0152.310] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0152.310] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0152.310] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0152.310] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x535240 [0152.310] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.310] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.311] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.311] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0152.311] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x198 [0152.312] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0152.368] GetFileSize (in: hFile=0x198, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ad0 [0152.368] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0152.369] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0152.376] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0152.425] ReadFile (in: hFile=0x198, lpBuffer=0x1d47098, nNumberOfBytesToRead=0x7ad0, lpNumberOfBytesRead=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesRead=0x19e574*=0x7ad0, lpOverlapped=0x0) returned 1 [0152.466] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47098*, nNumberOfBytesToWrite=0x7ae0, lpNumberOfBytesWritten=0x19e574, lpOverlapped=0x0 | out: lpBuffer=0x1d47098*, lpNumberOfBytesWritten=0x19e574*=0x7ae0, lpOverlapped=0x0) returned 1 [0152.467] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0152.484] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0152.487] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.494] CloseHandle (hObject=0x198) returned 1 [0152.494] CloseHandle (hObject=0x1a4) returned 1 [0152.494] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0152.495] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0152.495] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535380 [0152.495] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0 [0152.495] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0152.495] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll")) returned 1 [0152.496] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick\\Window.2\\windowplugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick\\window.2\\windowplugin.dll")) returned 0xffffffff [0152.496] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0152.497] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0152.497] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0152.497] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0152.497] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0152.497] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535400 [0152.497] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0152.497] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0152.497] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0152.498] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0152.498] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0152.499] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0152.572] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7ad0 [0152.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0152.572] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0152.580] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0152.622] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x7ad0, lpNumberOfBytesRead=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19e7dc*=0x7ad0, lpOverlapped=0x0) returned 1 [0152.664] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x7ae0, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19e7dc*=0x7ae0, lpOverlapped=0x0) returned 1 [0152.665] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0152.681] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0152.685] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.691] CloseHandle (hObject=0x1a0) returned 1 [0152.692] CloseHandle (hObject=0x1a4) returned 1 [0152.692] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0152.692] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0152.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534f40 [0152.693] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0152.693] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0152.693] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll")) returned 1 [0152.694] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qml\\QtQuick.2\\qtquick2plugin.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qml\\qtquick.2\\qtquick2plugin.dll")) returned 0xffffffff [0152.694] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0152.694] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0152.694] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0152.694] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0152.694] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0152.694] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0152.694] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0152.695] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48ead0 [0152.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0152.695] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0152.702] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0152.773] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x48ead0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x48ead0, lpOverlapped=0x0) returned 1 [0153.323] WriteFile (in: hFile=0x190, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x48eae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x48eae0, lpOverlapped=0x0) returned 1 [0153.385] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0153.400] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0153.403] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.410] CloseHandle (hObject=0x188) returned 1 [0153.410] CloseHandle (hObject=0x190) returned 1 [0153.410] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0153.411] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0153.411] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0153.411] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0153.411] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0153.411] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll")) returned 1 [0153.416] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Core.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5core.dll")) returned 0xffffffff [0153.416] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0153.416] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0153.416] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0153.416] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53ed0 [0153.416] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0153.417] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0153.423] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0153.469] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x53ed0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x53ed0, lpOverlapped=0x0) returned 1 [0153.493] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x53ee0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x53ee0, lpOverlapped=0x0) returned 1 [0153.497] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0153.512] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0153.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.522] CloseHandle (hObject=0x190) returned 1 [0153.522] CloseHandle (hObject=0x188) returned 1 [0153.523] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0153.523] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0153.523] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0153.523] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0153.523] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0153.523] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll")) returned 1 [0153.526] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5DBus.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5dbus.dll")) returned 0xffffffff [0153.526] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0153.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0153.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0153.527] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4becd0 [0153.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0153.527] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0153.534] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0153.575] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x4becd0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x4becd0, lpOverlapped=0x0) returned 1 [0153.789] WriteFile (in: hFile=0x190, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x4bece0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x4bece0, lpOverlapped=0x0) returned 1 [0153.856] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0153.874] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0153.878] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.885] CloseHandle (hObject=0x188) returned 1 [0153.885] CloseHandle (hObject=0x190) returned 1 [0153.885] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0153.886] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0153.886] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0153.886] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0153.886] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0153.886] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll")) returned 1 [0153.893] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Gui.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5gui.dll")) returned 0xffffffff [0153.893] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0153.893] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0153.893] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0153.894] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe4ad0 [0153.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0153.895] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0153.902] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0153.949] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0xe4ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0xe4ad0, lpOverlapped=0x0) returned 1 [0153.999] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0xe4ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0xe4ae0, lpOverlapped=0x0) returned 1 [0154.011] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0154.028] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0154.033] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.040] CloseHandle (hObject=0x190) returned 1 [0154.040] CloseHandle (hObject=0x188) returned 1 [0154.040] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0154.041] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0154.041] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0154.041] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0154.041] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0154.041] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll")) returned 1 [0154.048] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Network.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5network.dll")) returned 0xffffffff [0154.048] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0154.048] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0154.048] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0154.049] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x450d0 [0154.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0154.049] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0154.056] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0154.155] ReadFile (in: hFile=0x188, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x450d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x450d0, lpOverlapped=0x0) returned 1 [0154.178] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x450e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x450e0, lpOverlapped=0x0) returned 1 [0154.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0154.197] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0154.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.208] CloseHandle (hObject=0x188) returned 1 [0154.208] CloseHandle (hObject=0x190) returned 1 [0154.209] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0154.209] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0154.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0154.210] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0154.210] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0154.210] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll")) returned 1 [0154.212] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5PrintSupport.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5printsupport.dll")) returned 0xffffffff [0154.212] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0154.212] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0154.212] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0154.213] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x280cd0 [0154.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0154.213] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0154.220] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0154.262] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x280cd0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x280cd0, lpOverlapped=0x0) returned 1 [0154.378] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x280ce0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x280ce0, lpOverlapped=0x0) returned 1 [0154.418] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0154.434] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0154.437] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.444] CloseHandle (hObject=0x190) returned 1 [0154.444] CloseHandle (hObject=0x188) returned 1 [0154.444] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0154.445] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0154.445] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0154.445] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0154.445] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0154.445] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll")) returned 1 [0154.449] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Qml.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5qml.dll")) returned 0xffffffff [0154.449] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0154.449] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0154.449] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0154.468] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b9ad0 [0154.469] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0154.469] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0154.475] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0154.523] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x2b9ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x2b9ad0, lpOverlapped=0x0) returned 1 [0154.633] WriteFile (in: hFile=0x190, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x2b9ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x2b9ae0, lpOverlapped=0x0) returned 1 [0154.669] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0154.684] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0154.688] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.695] CloseHandle (hObject=0x188) returned 1 [0154.695] CloseHandle (hObject=0x190) returned 1 [0154.695] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0154.696] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0154.696] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0154.696] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0154.696] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0154.696] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll")) returned 1 [0154.701] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Quick.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quick.dll")) returned 0xffffffff [0154.701] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0154.702] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0154.702] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0154.703] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192d0 [0154.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0154.703] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0154.710] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0154.759] ReadFile (in: hFile=0x190, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x192d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x192d0, lpOverlapped=0x0) returned 1 [0154.775] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x192e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x192e0, lpOverlapped=0x0) returned 1 [0154.777] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0154.792] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0154.795] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.802] CloseHandle (hObject=0x190) returned 1 [0154.802] CloseHandle (hObject=0x188) returned 1 [0154.802] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0154.803] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0154.803] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0154.803] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0154.803] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0154.803] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll")) returned 1 [0154.804] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickControls2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quickcontrols2.dll")) returned 0xffffffff [0154.804] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0154.805] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0154.805] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0154.806] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b2d0 [0154.806] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0154.806] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0154.813] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0154.854] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x9b2d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ecac*=0x9b2d0, lpOverlapped=0x0) returned 1 [0154.882] WriteFile (in: hFile=0x190, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x9b2e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ecac*=0x9b2e0, lpOverlapped=0x0) returned 1 [0154.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0154.905] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0154.909] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.915] CloseHandle (hObject=0x188) returned 1 [0154.915] CloseHandle (hObject=0x190) returned 1 [0154.915] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0154.916] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0154.916] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0154.916] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0154.916] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0154.916] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll")) returned 1 [0154.921] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5QuickTemplates2.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5quicktemplates2.dll")) returned 0xffffffff [0154.921] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0154.921] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0154.921] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0154.921] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44ad0 [0154.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0154.922] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0154.930] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0154.971] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x44ad0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x44ad0, lpOverlapped=0x0) returned 1 [0154.988] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x44ae0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x44ae0, lpOverlapped=0x0) returned 1 [0154.992] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.007] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.011] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.017] CloseHandle (hObject=0x190) returned 1 [0155.017] CloseHandle (hObject=0x188) returned 1 [0155.017] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.018] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.018] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0155.018] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.018] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0155.018] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll")) returned 1 [0155.021] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Svg.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5svg.dll")) returned 0xffffffff [0155.021] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.021] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.021] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.022] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x442cd0 [0155.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.022] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.029] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.147] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x442cd0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x442cd0, lpOverlapped=0x0) returned 1 [0155.313] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x442ce0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x442ce0, lpOverlapped=0x0) returned 1 [0155.386] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.403] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.408] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.416] CloseHandle (hObject=0x188) returned 1 [0155.416] CloseHandle (hObject=0x190) returned 1 [0155.416] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.417] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.417] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0155.417] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.417] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0155.417] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll")) returned 1 [0155.420] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5Widgets.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5widgets.dll")) returned 0xffffffff [0155.420] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.420] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.420] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.422] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d0d0 [0155.422] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.422] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.431] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.482] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x3d0d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x3d0d0, lpOverlapped=0x0) returned 1 [0155.503] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x3d0e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x3d0e0, lpOverlapped=0x0) returned 1 [0155.506] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.521] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.524] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.531] CloseHandle (hObject=0x190) returned 1 [0155.531] CloseHandle (hObject=0x188) returned 1 [0155.531] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.532] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.532] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0155.532] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.532] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0155.532] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll")) returned 1 [0155.535] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Qt5WinExtras.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\qt5winextras.dll")) returned 0xffffffff [0155.535] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.536] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2266 [0155.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.536] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.543] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.584] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x2266, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x2266, lpOverlapped=0x0) returned 1 [0155.595] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x2270, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x2270, lpOverlapped=0x0) returned 1 [0155.596] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.611] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.614] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.621] CloseHandle (hObject=0x188) returned 1 [0155.621] CloseHandle (hObject=0x190) returned 1 [0155.621] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.621] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.621] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0155.622] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.622] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0155.622] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png")) returned 1 [0155.625] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaCritical.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotacritical.png")) returned 0xffffffff [0155.625] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.625] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.625] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.626] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244a [0155.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.626] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.633] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.674] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x244a, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x244a, lpOverlapped=0x0) returned 1 [0155.683] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x2450, lpOverlapped=0x0) returned 1 [0155.683] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.698] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.702] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.708] CloseHandle (hObject=0x190) returned 1 [0155.709] CloseHandle (hObject=0x188) returned 1 [0155.709] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.709] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.709] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534d00 [0155.710] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.710] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0155.710] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png")) returned 1 [0155.711] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaError.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotaerror.png")) returned 0xffffffff [0155.711] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.711] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.711] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.713] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d59 [0155.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.713] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.725] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.768] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x1d59, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x1d59, lpOverlapped=0x0) returned 1 [0155.779] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x1d60, lpOverlapped=0x0) returned 1 [0155.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.794] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.805] CloseHandle (hObject=0x188) returned 1 [0155.805] CloseHandle (hObject=0x190) returned 1 [0155.805] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.806] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.806] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0155.806] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.806] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0155.806] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png")) returned 1 [0155.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\QuotaNearing.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\quotanearing.png")) returned 0xffffffff [0155.807] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\qut-latn\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0155.807] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.807] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.807] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0155.808] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0155.808] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.808] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\quz-pe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0155.808] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.808] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.809] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0155.809] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0155.809] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.810] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9e4d0 [0155.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.810] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.857] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x9e4d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x9e4d0, lpOverlapped=0x0) returned 1 [0155.887] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x9e4e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x9e4e0, lpOverlapped=0x0) returned 1 [0155.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0155.909] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0155.912] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.919] CloseHandle (hObject=0x190) returned 1 [0155.919] CloseHandle (hObject=0x188) returned 1 [0155.919] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0155.920] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0155.920] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0155.920] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0155.920] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0155.920] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll")) returned 1 [0155.925] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\RemoteAccess.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\remoteaccess.dll")) returned 0xffffffff [0155.925] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.925] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ro\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0155.925] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.925] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.926] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0155.926] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0155.926] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.926] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ru\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0155.926] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.926] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.927] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0155.927] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0155.927] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.927] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\rw\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0155.927] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.927] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0155.927] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0155.927] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0155.928] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.928] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0155.928] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0155.929] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0155.930] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b721 [0155.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0155.930] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0155.936] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0155.978] ReadFile (in: hFile=0x188, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x3b721, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x3b721, lpOverlapped=0x0) returned 1 [0156.003] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x3b730, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x3b730, lpOverlapped=0x0) returned 1 [0156.006] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0156.021] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0156.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.031] CloseHandle (hObject=0x188) returned 1 [0156.031] CloseHandle (hObject=0x190) returned 1 [0156.031] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0156.032] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0156.032] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0156.033] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0156.033] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0156.033] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif")) returned 1 [0156.034] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ScreenshotOptIn.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\screenshotoptin.gif")) returned 0xffffffff [0156.035] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.035] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sd-arab\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0156.035] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.035] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.036] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.036] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0156.036] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.036] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\si-lk\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0156.036] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.036] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.036] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.036] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0156.036] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.037] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sk\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0156.037] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.037] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.038] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.038] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0156.038] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.038] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sl\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0156.038] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.038] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.038] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.038] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0156.038] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.038] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sq\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0156.039] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.039] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.039] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.039] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0156.039] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.040] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0156.040] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0156.040] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x320d0 [0156.040] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0156.041] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0156.047] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0156.175] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x320d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x320d0, lpOverlapped=0x0) returned 1 [0156.191] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x320e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x320e0, lpOverlapped=0x0) returned 1 [0156.194] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0156.210] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0156.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.221] CloseHandle (hObject=0x190) returned 1 [0156.221] CloseHandle (hObject=0x188) returned 1 [0156.221] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0156.222] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0156.222] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0156.222] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0156.222] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0156.222] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll")) returned 1 [0156.223] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sqmapi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\sqmapi.dll")) returned 0xffffffff [0156.224] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.224] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sr-cyrl-ba\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0156.224] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.224] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.224] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.224] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0156.224] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.224] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sr-cyrl-rs\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0156.225] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.225] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.226] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.226] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0156.226] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.226] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sr-latn-rs\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0156.226] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.226] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.226] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.226] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0156.226] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.227] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0156.227] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0156.227] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x478d0 [0156.227] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0156.228] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0156.234] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0156.275] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x478d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x478d0, lpOverlapped=0x0) returned 1 [0156.289] WriteFile (in: hFile=0x190, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x478e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x478e0, lpOverlapped=0x0) returned 1 [0156.293] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0156.308] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0156.312] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.319] CloseHandle (hObject=0x188) returned 1 [0156.319] CloseHandle (hObject=0x190) returned 1 [0156.319] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0156.320] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0156.320] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0156.320] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0156.320] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0156.320] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll")) returned 1 [0156.323] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ssleay32.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ssleay32.dll")) returned 0xffffffff [0156.323] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.323] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sv\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0156.323] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.324] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.324] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.324] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0156.324] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.324] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\sw\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0156.324] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.324] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.325] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.325] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0156.325] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.325] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0156.326] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0156.326] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51b0d0 [0156.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0156.326] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0156.333] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0156.376] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x500000, lpOverlapped=0x0) returned 1 [0156.596] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x500000, lpOverlapped=0x0) returned 1 [0156.665] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x1b0d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x1b0d0, lpOverlapped=0x0) returned 1 [0156.673] WriteFile (in: hFile=0x188, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x1b0e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x1b0e0, lpOverlapped=0x0) returned 1 [0156.676] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0156.692] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0156.695] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.702] CloseHandle (hObject=0x190) returned 1 [0156.702] CloseHandle (hObject=0x188) returned 1 [0156.703] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0156.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0156.703] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0156.703] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0156.703] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0156.704] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll")) returned 1 [0156.709] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\SyncEngine.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\syncengine.dll")) returned 0xffffffff [0156.709] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.709] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ta\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0156.709] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.709] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.710] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.710] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0156.710] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.710] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\te\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0156.710] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.710] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.711] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.711] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0156.711] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.711] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0156.711] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0156.712] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x560d0 [0156.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0156.712] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0156.719] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0156.782] ReadFile (in: hFile=0x188, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x560d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x560d0, lpOverlapped=0x0) returned 1 [0156.839] WriteFile (in: hFile=0x190, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x560e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x560e0, lpOverlapped=0x0) returned 1 [0156.844] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0156.859] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0156.863] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.870] CloseHandle (hObject=0x188) returned 1 [0156.870] CloseHandle (hObject=0x190) returned 1 [0156.870] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0156.871] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0156.871] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0156.871] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0156.871] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0156.871] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll")) returned 1 [0156.874] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Telemetry.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\telemetry.dll")) returned 0xffffffff [0156.874] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.874] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0156.875] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0156.876] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x484 [0156.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0156.876] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0156.883] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0156.925] ReadFile (in: hFile=0x190, lpBuffer=0x1d47088, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0x484, lpOverlapped=0x0) returned 1 [0156.934] WriteFile (in: hFile=0x188, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0x490, lpOverlapped=0x0) returned 1 [0156.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0156.950] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0156.954] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.961] CloseHandle (hObject=0x190) returned 1 [0156.961] CloseHandle (hObject=0x188) returned 1 [0156.961] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0156.962] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0156.962] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0156.962] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0156.962] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0156.962] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html")) returned 1 [0156.963] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\TestSharePage.html" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\testsharepage.html")) returned 0xffffffff [0156.963] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.963] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\tg-cyrl\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0156.963] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.963] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.963] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.963] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0156.964] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.964] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\th\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0156.964] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.964] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0156.964] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0156.964] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0156.964] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0156.965] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0156.965] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0156.966] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbfe9 [0156.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0156.966] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0156.973] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0157.015] ReadFile (in: hFile=0x188, lpBuffer=0x1d47088, nNumberOfBytesToRead=0xbfe9, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesRead=0x19ecac*=0xbfe9, lpOverlapped=0x0) returned 1 [0157.017] WriteFile (in: hFile=0x190, lpBuffer=0x1d47088*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47088*, lpNumberOfBytesWritten=0x19ecac*=0xbff0, lpOverlapped=0x0) returned 1 [0157.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0157.034] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0157.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.044] CloseHandle (hObject=0x188) returned 1 [0157.044] CloseHandle (hObject=0x190) returned 1 [0157.044] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0157.045] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0157.045] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0157.045] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0157.045] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0157.045] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt")) returned 1 [0157.046] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ThirdPartyNotices.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\thirdpartynotices.txt")) returned 0xffffffff [0157.047] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.047] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ti\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0157.047] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.047] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.048] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.048] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0157.048] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.048] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\tk-tm\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0157.048] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.048] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.049] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.049] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0157.049] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.049] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\tn-za\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0157.049] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.049] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.049] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.049] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0157.050] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.050] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\tr\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0157.050] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.050] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.051] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.051] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0157.051] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.051] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\tt\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0157.051] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.051] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.052] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.052] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0157.052] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.052] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0157.052] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0157.053] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11ccc8 [0157.053] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0157.053] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0157.060] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0157.176] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x11ccc8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x11ccc8, lpOverlapped=0x0) returned 1 [0157.260] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x11ccd0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x11ccd0, lpOverlapped=0x0) returned 1 [0157.276] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0157.291] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0157.295] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.302] CloseHandle (hObject=0x190) returned 1 [0157.302] CloseHandle (hObject=0x188) returned 1 [0157.302] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0157.303] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0157.303] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0157.303] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0157.303] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0157.303] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll")) returned 1 [0157.304] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ucrtbase.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\ucrtbase.dll")) returned 0xffffffff [0157.304] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.304] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ug-arab\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0157.304] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.304] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.305] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.305] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0157.305] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.305] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\uk\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0157.306] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.306] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.306] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.306] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0157.306] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.306] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\ur\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0157.307] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.307] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.307] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.307] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0157.307] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.307] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\uz-latn-uz\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0157.308] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.308] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.308] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.308] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0157.308] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.308] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0157.308] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0157.309] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144d0 [0157.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0157.309] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0157.316] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0157.363] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x144d0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x144d0, lpOverlapped=0x0) returned 1 [0157.374] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x144e0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x144e0, lpOverlapped=0x0) returned 1 [0157.376] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0157.391] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0157.395] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.402] CloseHandle (hObject=0x188) returned 1 [0157.402] CloseHandle (hObject=0x190) returned 1 [0157.402] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0157.403] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0157.403] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0157.403] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0157.403] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0157.404] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll")) returned 1 [0157.405] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vcruntime140.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\vcruntime140.dll")) returned 0xffffffff [0157.405] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.405] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\vi\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0157.406] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.406] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.406] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.406] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0157.406] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.407] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0157.407] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0157.408] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa21 [0157.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0157.408] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0157.415] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0157.457] ReadFile (in: hFile=0x190, lpBuffer=0x1d47080, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0xa21, lpOverlapped=0x0) returned 1 [0157.647] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0xa30, lpOverlapped=0x0) returned 1 [0157.648] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0157.663] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0157.666] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.673] CloseHandle (hObject=0x190) returned 1 [0157.673] CloseHandle (hObject=0x188) returned 1 [0157.673] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0157.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0157.674] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0157.674] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0157.674] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0157.674] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png")) returned 1 [0157.675] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\Warning.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\warning.png")) returned 0xffffffff [0157.675] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.675] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0157.676] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0157.701] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fcd0 [0157.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0157.701] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0157.708] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0157.755] ReadFile (in: hFile=0x188, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x5fcd0, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x5fcd0, lpOverlapped=0x0) returned 1 [0157.876] WriteFile (in: hFile=0x190, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x5fce0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x5fce0, lpOverlapped=0x0) returned 1 [0157.881] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0157.896] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0157.900] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.906] CloseHandle (hObject=0x188) returned 1 [0157.906] CloseHandle (hObject=0x190) returned 1 [0157.906] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0157.907] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0157.907] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0157.908] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0157.908] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0157.908] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll")) returned 1 [0157.910] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\WnsClientApi.dll" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\17.3.6998.0830\\wnsclientapi.dll")) returned 0xffffffff [0157.911] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.911] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\wo\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0157.911] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.911] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.912] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.912] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0157.912] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.912] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\xh-za\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0157.912] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.912] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.913] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.913] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0157.913] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.913] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\yo-ng\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0157.915] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.915] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.916] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.916] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0157.916] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.916] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\zh-cn\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0157.916] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.916] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.917] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.917] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0157.917] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.917] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\zh-tw\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0157.917] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.917] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.918] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.918] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0157.918] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.918] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\17.3.6998.0830\\zu-za\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0157.918] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.918] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.919] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.919] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0157.919] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0157.919] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0157.919] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0157.919] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\logs\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0157.919] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.919] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.919] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Common\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0157.961] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.961] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.962] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.962] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.963] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.963] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.964] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.965] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.965] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.966] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.966] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.967] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0157.967] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0157.967] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0157.968] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0157.968] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\logs\\Personal\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0158.075] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.075] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.075] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.076] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.077] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0158.077] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0158.078] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0158.078] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0158.078] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0158.078] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0158.078] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0158.121] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0158.126] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d [0158.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0158.126] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0158.133] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0158.177] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47078, nNumberOfBytesToRead=0x4d, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesRead=0x19ef14*=0x4d, lpOverlapped=0x0) returned 1 [0158.178] WriteFile (in: hFile=0x190, lpBuffer=0x1d47078*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesWritten=0x19ef14*=0x50, lpOverlapped=0x0) returned 1 [0158.178] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0158.193] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0158.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.203] CloseHandle (hObject=0x19c) returned 1 [0158.203] CloseHandle (hObject=0x190) returned 1 [0158.203] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0158.204] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0158.204] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0158.204] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0158.204] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0158.205] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd")) returned 1 [0158.205] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\OneDrivePersonal.cmd" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\onedrivepersonal.cmd")) returned 0xffffffff [0158.205] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0158.206] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0158.206] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0158.206] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0158.206] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0158.206] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e40 [0158.207] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.207] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.208] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0158.208] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0158.208] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2490 [0158.208] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0158.209] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0158.218] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0158.273] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x2490, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x2490, lpOverlapped=0x0) returned 1 [0158.315] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x24a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x24a0, lpOverlapped=0x0) returned 1 [0158.316] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0158.331] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0158.336] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.342] CloseHandle (hObject=0x188) returned 1 [0158.342] CloseHandle (hObject=0x1a4) returned 1 [0158.342] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0158.343] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0158.343] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0158.343] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0158.343] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0158.343] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log")) returned 1 [0158.344] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121120_934-848.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121120_934-848.log")) returned 0xffffffff [0158.344] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.345] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0158.345] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0158.346] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x220a [0158.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0158.346] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0158.353] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0158.394] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x220a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x220a, lpOverlapped=0x0) returned 1 [0158.490] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x2210, lpOverlapped=0x0) returned 1 [0158.491] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0158.506] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0158.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.516] CloseHandle (hObject=0x1a4) returned 1 [0158.516] CloseHandle (hObject=0x188) returned 1 [0158.516] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0158.517] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0158.517] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0158.517] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0158.517] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0158.517] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log")) returned 1 [0158.518] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_121121_d68-ddc.log")) returned 0xffffffff [0158.518] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.519] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0158.519] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0158.520] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2490 [0158.520] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0158.520] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0158.527] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0158.571] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x2490, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x2490, lpOverlapped=0x0) returned 1 [0158.609] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x24a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x24a0, lpOverlapped=0x0) returned 1 [0158.609] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0158.624] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0158.628] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.635] CloseHandle (hObject=0x188) returned 1 [0158.635] CloseHandle (hObject=0x1a4) returned 1 [0158.635] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0158.635] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0158.636] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0158.636] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0158.636] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0158.636] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log")) returned 1 [0158.637] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123817_760-808.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123817_760-808.log")) returned 0xffffffff [0158.637] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0158.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0158.735] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x220a [0158.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0158.736] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0158.742] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0158.786] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x220a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x220a, lpOverlapped=0x0) returned 1 [0158.819] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x2210, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x2210, lpOverlapped=0x0) returned 1 [0158.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0158.835] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0158.838] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.845] CloseHandle (hObject=0x1a4) returned 1 [0158.845] CloseHandle (hObject=0x188) returned 1 [0158.845] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0158.846] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0158.846] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0158.846] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0158.846] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0158.846] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log")) returned 1 [0158.847] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_123818_e38-824.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_123818_e38-824.log")) returned 0xffffffff [0158.847] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0158.847] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0158.847] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0158.879] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x249e [0158.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0158.879] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0158.887] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0158.932] ReadFile (in: hFile=0x188, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x249e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x249e, lpOverlapped=0x0) returned 1 [0158.997] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x24a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x24a0, lpOverlapped=0x0) returned 1 [0158.998] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0159.013] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0159.017] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.023] CloseHandle (hObject=0x188) returned 1 [0159.023] CloseHandle (hObject=0x1a4) returned 1 [0159.023] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0159.024] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0159.024] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0159.024] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0159.024] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0159.024] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log")) returned 1 [0159.025] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_864-704.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_864-704.log")) returned 0xffffffff [0159.025] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0159.026] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0159.026] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0159.026] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21f8 [0159.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0159.027] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0159.033] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0159.149] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4708c, nNumberOfBytesToRead=0x21f8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesRead=0x19ea44*=0x21f8, lpOverlapped=0x0) returned 1 [0159.152] WriteFile (in: hFile=0x188, lpBuffer=0x1d4708c*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4708c*, lpNumberOfBytesWritten=0x19ea44*=0x2200, lpOverlapped=0x0) returned 1 [0159.301] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0159.315] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0159.319] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.325] CloseHandle (hObject=0x1a4) returned 1 [0159.325] CloseHandle (hObject=0x188) returned 1 [0159.325] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0159.326] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0159.326] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0159.326] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0159.326] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0159.326] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log")) returned 1 [0159.327] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2017-07-21_133220_ae0-29c.log")) returned 0xffffffff [0159.327] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0159.328] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0159.328] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0159.330] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7170c [0159.330] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0159.330] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0159.338] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0159.382] ReadFile (in: hFile=0x188, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x7170c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ea44*=0x7170c, lpOverlapped=0x0) returned 1 [0159.522] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x71710, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ea44*=0x71710, lpOverlapped=0x0) returned 1 [0159.528] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0159.543] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0159.546] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.553] CloseHandle (hObject=0x188) returned 1 [0159.553] CloseHandle (hObject=0x1a4) returned 1 [0159.553] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0159.554] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0159.554] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0159.554] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0159.554] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0159.554] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log")) returned 1 [0159.557] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-05-24_104601_b30-494.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-05-24_104601_b30-494.log")) returned 0xffffffff [0159.557] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0159.558] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0159.558] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0159.558] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8d2d4 [0159.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0159.559] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0159.567] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0159.610] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x8d2d4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ea44*=0x8d2d4, lpOverlapped=0x0) returned 1 [0159.742] WriteFile (in: hFile=0x188, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x8d2e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ea44*=0x8d2e0, lpOverlapped=0x0) returned 1 [0159.749] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0159.764] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0159.768] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.776] CloseHandle (hObject=0x1a4) returned 1 [0159.776] CloseHandle (hObject=0x188) returned 1 [0159.776] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0159.776] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0159.777] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0159.777] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0159.777] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0159.777] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log")) returned 1 [0159.781] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-07-12_164141_b14-7f0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-07-12_164141_b14-7f0.log")) returned 0xffffffff [0159.781] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0159.781] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0159.781] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0159.783] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x938cc [0159.783] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0159.784] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0159.791] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0159.837] ReadFile (in: hFile=0x188, lpBuffer=0x1d4709c, nNumberOfBytesToRead=0x938cc, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesRead=0x19ea44*=0x938cc, lpOverlapped=0x0) returned 1 [0160.263] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4709c*, nNumberOfBytesToWrite=0x938d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4709c*, lpNumberOfBytesWritten=0x19ea44*=0x938d0, lpOverlapped=0x0) returned 1 [0160.270] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0160.286] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0160.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.301] CloseHandle (hObject=0x188) returned 1 [0160.301] CloseHandle (hObject=0x1a4) returned 1 [0160.301] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0160.302] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0160.302] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0160.302] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0160.302] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0160.302] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log")) returned 1 [0160.308] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install-PerUser_2017-09-26_160326_bb4-8e8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install-peruser_2017-09-26_160326_bb4-8e8.log")) returned 0xffffffff [0160.308] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.308] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0160.309] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0160.309] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16ee6 [0160.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0160.310] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0160.318] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0160.364] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x16ee6, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ea44*=0x16ee6, lpOverlapped=0x0) returned 1 [0160.398] WriteFile (in: hFile=0x188, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x16ef0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ea44*=0x16ef0, lpOverlapped=0x0) returned 1 [0160.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0160.414] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0160.418] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.424] CloseHandle (hObject=0x1a4) returned 1 [0160.424] CloseHandle (hObject=0x188) returned 1 [0160.424] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0160.425] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0160.426] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0160.426] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0160.426] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0160.426] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log")) returned 1 [0160.427] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-05-24_104600_528-57c.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-05-24_104600_528-57c.log")) returned 0xffffffff [0160.427] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.427] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0160.427] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0160.428] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b89a [0160.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0160.428] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0160.435] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0160.480] ReadFile (in: hFile=0x188, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x1b89a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ea44*=0x1b89a, lpOverlapped=0x0) returned 1 [0160.600] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x1b8a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ea44*=0x1b8a0, lpOverlapped=0x0) returned 1 [0160.602] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0160.617] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0160.620] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.628] CloseHandle (hObject=0x188) returned 1 [0160.628] CloseHandle (hObject=0x1a4) returned 1 [0160.629] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0160.629] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0160.629] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0160.629] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0160.629] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0160.630] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log")) returned 1 [0160.631] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-07-12_164138_904-4d0.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-07-12_164138_904-4d0.log")) returned 0xffffffff [0160.631] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.631] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0160.631] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0160.685] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d2e0 [0160.685] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0160.685] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0160.691] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0160.737] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47094, nNumberOfBytesToRead=0x1d2e0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesRead=0x19ea44*=0x1d2e0, lpOverlapped=0x0) returned 1 [0160.750] WriteFile (in: hFile=0x188, lpBuffer=0x1d47094*, nNumberOfBytesToWrite=0x1d2f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47094*, lpNumberOfBytesWritten=0x19ea44*=0x1d2f0, lpOverlapped=0x0) returned 1 [0160.752] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0160.767] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0160.771] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.778] CloseHandle (hObject=0x1a4) returned 1 [0160.778] CloseHandle (hObject=0x188) returned 1 [0160.778] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0160.779] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0160.779] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0160.779] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0160.779] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0160.779] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log")) returned 1 [0160.780] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\Install_2017-09-26_160323_3a0-354.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\install_2017-09-26_160323_3a0-354.log")) returned 0xffffffff [0160.780] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.781] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.781] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.782] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0160.782] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0160.783] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10de [0160.783] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0160.783] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0160.790] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0160.832] ReadFile (in: hFile=0x188, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x10de, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x10de, lpOverlapped=0x0) returned 1 [0160.833] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x10e0, lpOverlapped=0x0) returned 1 [0160.834] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0160.849] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0160.852] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.860] CloseHandle (hObject=0x188) returned 1 [0160.860] CloseHandle (hObject=0x1a4) returned 1 [0160.860] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0160.861] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0160.861] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0160.861] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0160.861] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0160.861] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log")) returned 1 [0160.862] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-12_164130_2e0-2c8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-12_164130_2e0-2c8.log")) returned 0xffffffff [0160.862] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0160.863] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0160.863] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0160.863] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d4 [0160.863] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0160.864] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0160.871] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0160.912] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x7d4, lpOverlapped=0x0) returned 1 [0161.005] WriteFile (in: hFile=0x188, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x7e0, lpOverlapped=0x0) returned 1 [0161.006] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.021] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.031] CloseHandle (hObject=0x1a4) returned 1 [0161.031] CloseHandle (hObject=0x188) returned 1 [0161.031] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.032] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.032] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0161.032] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.032] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0161.032] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log")) returned 1 [0161.033] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-13_111425_fe4-f74.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-13_111425_fe4-f74.log")) returned 0xffffffff [0161.033] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.034] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.034] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.035] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d6 [0161.035] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.035] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.042] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.106] ReadFile (in: hFile=0x188, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x7d6, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x7d6, lpOverlapped=0x0) returned 1 [0161.203] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x7e0, lpOverlapped=0x0) returned 1 [0161.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.307] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.311] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.317] CloseHandle (hObject=0x188) returned 1 [0161.318] CloseHandle (hObject=0x1a4) returned 1 [0161.318] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.318] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.318] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0161.319] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.319] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0161.319] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log")) returned 1 [0161.319] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-14_075507_d98-d94.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-14_075507_d98-d94.log")) returned 0xffffffff [0161.320] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.320] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.320] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.321] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d6 [0161.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.321] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.328] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.369] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x7d6, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x7d6, lpOverlapped=0x0) returned 1 [0161.491] WriteFile (in: hFile=0x188, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x7e0, lpOverlapped=0x0) returned 1 [0161.492] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.507] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.511] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.517] CloseHandle (hObject=0x1a4) returned 1 [0161.517] CloseHandle (hObject=0x188) returned 1 [0161.518] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.518] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.518] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0161.519] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.519] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0161.519] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log")) returned 1 [0161.520] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-19_092447_b70-3a8.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-19_092447_b70-3a8.log")) returned 0xffffffff [0161.520] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.520] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.520] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.521] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d6 [0161.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.521] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.528] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.580] ReadFile (in: hFile=0x188, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x7d6, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x7d6, lpOverlapped=0x0) returned 1 [0161.592] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x7e0, lpOverlapped=0x0) returned 1 [0161.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.608] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.619] CloseHandle (hObject=0x188) returned 1 [0161.619] CloseHandle (hObject=0x1a4) returned 1 [0161.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0161.620] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.620] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0161.620] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log")) returned 1 [0161.621] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-07-21_115555_e74-e78.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-07-21_115555_e74-e78.log")) returned 0xffffffff [0161.621] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.621] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.621] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.622] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10ce [0161.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.622] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.629] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.674] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x10ce, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x10ce, lpOverlapped=0x0) returned 1 [0161.683] WriteFile (in: hFile=0x188, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x10d0, lpOverlapped=0x0) returned 1 [0161.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.699] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.703] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.710] CloseHandle (hObject=0x1a4) returned 1 [0161.710] CloseHandle (hObject=0x188) returned 1 [0161.710] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.711] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.711] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0161.711] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.711] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0161.711] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log")) returned 1 [0161.712] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-26_160311_e54-e58.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-26_160311_e54-e58.log")) returned 0xffffffff [0161.712] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.712] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.713] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.713] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d8 [0161.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.713] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.720] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.772] ReadFile (in: hFile=0x188, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x7d8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ea44*=0x7d8, lpOverlapped=0x0) returned 1 [0161.776] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ea44*=0x7e0, lpOverlapped=0x0) returned 1 [0161.777] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.791] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.795] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.802] CloseHandle (hObject=0x188) returned 1 [0161.802] CloseHandle (hObject=0x1a4) returned 1 [0161.802] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.803] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.803] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0161.803] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.803] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0161.803] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log")) returned 1 [0161.804] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\StandaloneUpdate_2017-09-27_084159_4e4-594.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\standaloneupdate_2017-09-27_084159_4e4-594.log")) returned 0xffffffff [0161.804] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.805] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.805] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0161.805] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0161.805] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0161.805] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0161.805] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0161.805] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0161.806] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0161.806] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0161.806] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0161.807] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0161.807] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0161.807] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0161.807] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0161.807] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0161.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535000 [0161.807] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0161.807] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0161.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0161.808] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0161.808] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0161.808] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\Backup\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0161.808] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.808] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0161.808] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0161.809] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0161.809] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0161.817] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.818] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.818] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.819] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.819] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0161.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.820] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.826] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.867] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x3000, lpOverlapped=0x0) returned 1 [0161.873] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x3010, lpOverlapped=0x0) returned 1 [0161.874] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.888] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.892] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.898] CloseHandle (hObject=0x1a4) returned 1 [0161.898] CloseHandle (hObject=0x188) returned 1 [0161.898] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.899] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.899] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0161.899] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.899] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0161.899] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin")) returned 1 [0161.900] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000000.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000000.bin")) returned 0xffffffff [0161.901] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.901] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.901] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.902] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5000 [0161.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.902] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.908] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0161.949] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x5000, lpOverlapped=0x0) returned 1 [0161.950] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x5010, lpOverlapped=0x0) returned 1 [0161.951] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0161.967] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0161.970] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.976] CloseHandle (hObject=0x188) returned 1 [0161.977] CloseHandle (hObject=0x1a4) returned 1 [0161.977] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0161.977] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0161.978] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0161.978] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0161.978] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0161.978] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin")) returned 1 [0161.979] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000001.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000001.bin")) returned 0xffffffff [0161.979] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0161.979] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0161.979] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0161.979] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x387a [0161.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0161.980] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0161.986] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.028] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x387a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x387a, lpOverlapped=0x0) returned 1 [0162.041] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x3880, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x3880, lpOverlapped=0x0) returned 1 [0162.042] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.057] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.060] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.067] CloseHandle (hObject=0x1a4) returned 1 [0162.067] CloseHandle (hObject=0x188) returned 1 [0162.067] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.068] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.068] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0162.068] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.068] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0162.068] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin")) returned 0 [0162.068] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000004.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000004.bin")) returned 0x21 [0162.068] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.068] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.068] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.194] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b23 [0162.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.194] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.201] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.241] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x4b23, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x4b23, lpOverlapped=0x0) returned 1 [0162.371] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x4b30, lpOverlapped=0x0) returned 1 [0162.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.387] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.391] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.397] CloseHandle (hObject=0x188) returned 1 [0162.397] CloseHandle (hObject=0x1a4) returned 1 [0162.397] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.398] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.398] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0162.398] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.398] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0162.398] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin")) returned 0 [0162.399] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000005.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000005.bin")) returned 0x21 [0162.399] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.399] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.399] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.400] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x644 [0162.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.401] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.407] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.452] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x644, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x644, lpOverlapped=0x0) returned 1 [0162.473] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x650, lpOverlapped=0x0) returned 1 [0162.473] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.489] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.492] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.499] CloseHandle (hObject=0x1a4) returned 1 [0162.499] CloseHandle (hObject=0x188) returned 1 [0162.499] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.500] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.500] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0162.500] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.500] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0162.500] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin")) returned 0 [0162.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000006.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000006.bin")) returned 0x21 [0162.501] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.501] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.502] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8b8 [0162.502] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.503] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.509] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.551] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x8b8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x8b8, lpOverlapped=0x0) returned 1 [0162.561] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x8c0, lpOverlapped=0x0) returned 1 [0162.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.576] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.580] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.586] CloseHandle (hObject=0x188) returned 1 [0162.586] CloseHandle (hObject=0x1a4) returned 1 [0162.586] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.587] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.587] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0162.587] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.587] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0162.587] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin")) returned 0 [0162.588] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000007.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000007.bin")) returned 0x21 [0162.588] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.588] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.588] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.589] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5f [0162.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.589] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.596] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.637] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xe5f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0xe5f, lpOverlapped=0x0) returned 1 [0162.638] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0xe60, lpOverlapped=0x0) returned 1 [0162.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.655] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.658] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.665] CloseHandle (hObject=0x1a4) returned 1 [0162.665] CloseHandle (hObject=0x188) returned 1 [0162.665] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.666] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.666] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0162.666] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.666] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0162.666] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin")) returned 0 [0162.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000008.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000008.bin")) returned 0x21 [0162.667] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.667] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.667] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.668] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x32e6 [0162.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.668] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.675] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.717] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x32e6, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x32e6, lpOverlapped=0x0) returned 1 [0162.735] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x32f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x32f0, lpOverlapped=0x0) returned 1 [0162.736] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.752] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.755] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.762] CloseHandle (hObject=0x188) returned 1 [0162.762] CloseHandle (hObject=0x1a4) returned 1 [0162.763] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.763] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.763] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0162.764] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.764] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0162.764] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin")) returned 0 [0162.764] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000009.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000009.bin")) returned 0x21 [0162.764] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.764] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.764] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.765] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x150a [0162.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.765] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.772] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.816] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x150a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x150a, lpOverlapped=0x0) returned 1 [0162.830] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1510, lpOverlapped=0x0) returned 1 [0162.831] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.847] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.852] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.861] CloseHandle (hObject=0x1a4) returned 1 [0162.861] CloseHandle (hObject=0x188) returned 1 [0162.861] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.862] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.862] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0162.862] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.862] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0162.862] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin")) returned 0 [0162.863] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000C.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000c.bin")) returned 0x21 [0162.863] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.863] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.863] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.878] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cce [0162.878] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.878] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.886] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0162.927] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1cce, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x1cce, lpOverlapped=0x0) returned 1 [0162.939] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1cd0, lpOverlapped=0x0) returned 1 [0162.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0162.955] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0162.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.966] CloseHandle (hObject=0x188) returned 1 [0162.966] CloseHandle (hObject=0x1a4) returned 1 [0162.966] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0162.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0162.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0162.967] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0162.967] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0162.967] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin")) returned 0 [0162.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000D.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000d.bin")) returned 0x21 [0162.967] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0162.967] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0162.968] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0162.968] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ef [0162.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0162.969] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0162.975] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.016] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x12ef, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x12ef, lpOverlapped=0x0) returned 1 [0163.017] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x12f0, lpOverlapped=0x0) returned 1 [0163.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.033] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.043] CloseHandle (hObject=0x1a4) returned 1 [0163.044] CloseHandle (hObject=0x188) returned 1 [0163.044] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.044] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.045] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0163.045] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.045] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0163.045] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin")) returned 0 [0163.045] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000F.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000f.bin")) returned 0x21 [0163.045] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.045] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.045] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.047] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a2 [0163.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.047] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.054] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.172] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x8a2, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x8a2, lpOverlapped=0x0) returned 1 [0163.173] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x8b0, lpOverlapped=0x0) returned 1 [0163.174] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.188] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.192] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.199] CloseHandle (hObject=0x188) returned 1 [0163.199] CloseHandle (hObject=0x1a4) returned 1 [0163.199] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.199] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.200] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0163.200] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.200] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0163.200] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin")) returned 0 [0163.200] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000G.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000g.bin")) returned 0x21 [0163.200] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.200] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.201] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.201] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x679 [0163.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.201] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.208] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.249] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x679, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x679, lpOverlapped=0x0) returned 1 [0163.250] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x680, lpOverlapped=0x0) returned 1 [0163.250] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.265] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.269] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.275] CloseHandle (hObject=0x1a4) returned 1 [0163.276] CloseHandle (hObject=0x188) returned 1 [0163.276] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.276] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.276] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0163.276] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.276] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0163.277] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin")) returned 0 [0163.277] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000H.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000h.bin")) returned 0x21 [0163.277] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.277] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.277] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.278] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf27 [0163.278] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.278] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.284] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.325] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xf27, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0xf27, lpOverlapped=0x0) returned 1 [0163.327] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0xf30, lpOverlapped=0x0) returned 1 [0163.327] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.342] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.346] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.352] CloseHandle (hObject=0x188) returned 1 [0163.352] CloseHandle (hObject=0x1a4) returned 1 [0163.352] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.353] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.353] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0163.354] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.354] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0163.354] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin")) returned 0 [0163.354] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000I.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000i.bin")) returned 0x21 [0163.354] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.354] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.354] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.355] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x331c [0163.355] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.356] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.362] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.403] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x331c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x331c, lpOverlapped=0x0) returned 1 [0163.422] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x3320, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x3320, lpOverlapped=0x0) returned 1 [0163.423] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.438] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.441] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.448] CloseHandle (hObject=0x1a4) returned 1 [0163.448] CloseHandle (hObject=0x188) returned 1 [0163.448] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.449] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.449] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0163.449] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.449] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0163.449] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin")) returned 0 [0163.449] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000J.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000j.bin")) returned 0x21 [0163.449] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.450] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.450] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.451] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91c [0163.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.451] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.458] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.499] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x91c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x91c, lpOverlapped=0x0) returned 1 [0163.500] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x920, lpOverlapped=0x0) returned 1 [0163.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.516] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.519] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.526] CloseHandle (hObject=0x188) returned 1 [0163.526] CloseHandle (hObject=0x1a4) returned 1 [0163.526] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.527] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.527] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0163.527] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.527] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0163.527] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin")) returned 0 [0163.528] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000l.bin")) returned 0x21 [0163.528] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.528] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.528] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.529] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1055 [0163.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.529] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.536] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.577] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1055, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x1055, lpOverlapped=0x0) returned 1 [0163.593] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1060, lpOverlapped=0x0) returned 1 [0163.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.608] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.619] CloseHandle (hObject=0x1a4) returned 1 [0163.619] CloseHandle (hObject=0x188) returned 1 [0163.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.619] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.619] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0163.620] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.620] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0163.620] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin")) returned 0 [0163.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000m.bin")) returned 0x21 [0163.620] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.620] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.621] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.622] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x586a [0163.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.622] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.629] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.671] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x586a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x586a, lpOverlapped=0x0) returned 1 [0163.675] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x5870, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x5870, lpOverlapped=0x0) returned 1 [0163.676] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.692] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.695] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.702] CloseHandle (hObject=0x188) returned 1 [0163.702] CloseHandle (hObject=0x1a4) returned 1 [0163.702] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.703] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0163.703] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.703] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0163.703] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin")) returned 0 [0163.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000n.bin")) returned 0x21 [0163.703] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.703] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.704] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.705] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e83 [0163.705] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.705] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.711] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.757] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x3e83, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x3e83, lpOverlapped=0x0) returned 1 [0163.759] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x3e90, lpOverlapped=0x0) returned 1 [0163.760] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.774] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.785] CloseHandle (hObject=0x1a4) returned 1 [0163.785] CloseHandle (hObject=0x188) returned 1 [0163.785] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.786] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.786] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0163.786] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.786] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0163.786] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin")) returned 0 [0163.787] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000O.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000o.bin")) returned 0x21 [0163.787] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.787] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.787] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.788] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4389 [0163.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.788] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.795] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.837] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x4389, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x4389, lpOverlapped=0x0) returned 1 [0163.853] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x4390, lpOverlapped=0x0) returned 1 [0163.854] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.869] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.873] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.879] CloseHandle (hObject=0x188) returned 1 [0163.879] CloseHandle (hObject=0x1a4) returned 1 [0163.879] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.880] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.880] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0163.880] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.880] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0163.880] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin")) returned 0 [0163.880] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000P.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000p.bin")) returned 0x21 [0163.880] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.881] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.881] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.882] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x118a [0163.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.883] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.889] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0163.935] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x118a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x118a, lpOverlapped=0x0) returned 1 [0163.936] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1190, lpOverlapped=0x0) returned 1 [0163.937] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0163.954] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0163.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.967] CloseHandle (hObject=0x1a4) returned 1 [0163.967] CloseHandle (hObject=0x188) returned 1 [0163.967] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0163.969] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0163.969] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0163.969] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0163.969] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0163.969] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin")) returned 0 [0163.969] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000Q.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000q.bin")) returned 0x21 [0163.969] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0163.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0163.970] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0163.973] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ff8 [0163.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0163.973] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0163.980] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.023] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1ff8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x1ff8, lpOverlapped=0x0) returned 1 [0164.038] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x2000, lpOverlapped=0x0) returned 1 [0164.039] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.055] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.059] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.066] CloseHandle (hObject=0x188) returned 1 [0164.066] CloseHandle (hObject=0x1a4) returned 1 [0164.066] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.067] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.067] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0164.067] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.067] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0164.067] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin")) returned 0 [0164.067] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000R.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000r.bin")) returned 0x21 [0164.067] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.067] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.068] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.069] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1055 [0164.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.069] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.169] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.215] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1055, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x1055, lpOverlapped=0x0) returned 1 [0164.217] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1060, lpOverlapped=0x0) returned 1 [0164.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.235] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.238] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.245] CloseHandle (hObject=0x1a4) returned 1 [0164.245] CloseHandle (hObject=0x188) returned 1 [0164.245] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.246] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.246] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0164.246] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.246] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0164.246] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin")) returned 0 [0164.247] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000S.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000s.bin")) returned 0x21 [0164.247] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.247] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.247] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.248] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105e [0164.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.249] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.255] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.296] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x105e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x105e, lpOverlapped=0x0) returned 1 [0164.319] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1060, lpOverlapped=0x0) returned 1 [0164.320] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.334] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.340] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.349] CloseHandle (hObject=0x188) returned 1 [0164.349] CloseHandle (hObject=0x1a4) returned 1 [0164.349] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.350] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.350] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0164.351] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.351] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0164.351] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin")) returned 0 [0164.351] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000T.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000t.bin")) returned 0x21 [0164.351] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.351] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.352] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.367] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x35a9 [0164.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.367] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.375] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.419] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x35a9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x35a9, lpOverlapped=0x0) returned 1 [0164.453] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x35b0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x35b0, lpOverlapped=0x0) returned 1 [0164.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.469] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.473] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.479] CloseHandle (hObject=0x1a4) returned 1 [0164.479] CloseHandle (hObject=0x188) returned 1 [0164.479] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.480] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.480] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0164.480] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.480] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0164.480] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin")) returned 0 [0164.481] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000u.bin")) returned 0x21 [0164.481] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.481] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.481] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.482] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff1 [0164.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.482] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.488] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.532] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xff1, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0xff1, lpOverlapped=0x0) returned 1 [0164.533] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1000, lpOverlapped=0x0) returned 1 [0164.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.549] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.552] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.559] CloseHandle (hObject=0x188) returned 1 [0164.559] CloseHandle (hObject=0x1a4) returned 1 [0164.559] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.560] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.560] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0164.560] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.560] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0164.560] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin")) returned 0 [0164.560] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000000V.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000000v.bin")) returned 0x21 [0164.560] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.560] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.563] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x784 [0164.563] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.563] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.570] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.611] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x784, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x784, lpOverlapped=0x0) returned 1 [0164.623] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x790, lpOverlapped=0x0) returned 1 [0164.624] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.639] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.642] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.649] CloseHandle (hObject=0x1a4) returned 1 [0164.649] CloseHandle (hObject=0x188) returned 1 [0164.649] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.650] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.650] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0164.650] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.650] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0164.650] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin")) returned 0 [0164.650] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000010.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000010.bin")) returned 0x21 [0164.650] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.650] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.651] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.671] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa27 [0164.671] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.671] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.677] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.719] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xa27, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0xa27, lpOverlapped=0x0) returned 1 [0164.720] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0xa30, lpOverlapped=0x0) returned 1 [0164.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.740] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.744] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.751] CloseHandle (hObject=0x188) returned 1 [0164.751] CloseHandle (hObject=0x1a4) returned 1 [0164.751] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.751] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.751] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0164.752] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.752] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0164.752] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin")) returned 0 [0164.752] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000011.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000011.bin")) returned 0x21 [0164.752] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.752] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.752] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.754] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2cb9 [0164.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.754] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.761] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.802] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x2cb9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x2cb9, lpOverlapped=0x0) returned 1 [0164.813] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x2cc0, lpOverlapped=0x0) returned 1 [0164.813] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.828] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.832] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.841] CloseHandle (hObject=0x1a4) returned 1 [0164.841] CloseHandle (hObject=0x188) returned 1 [0164.841] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.841] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.841] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0164.842] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.842] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0164.842] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin")) returned 0 [0164.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000012.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000012.bin")) returned 0x21 [0164.842] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.842] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.843] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.844] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38d9 [0164.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.844] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.851] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.892] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x38d9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x38d9, lpOverlapped=0x0) returned 1 [0164.906] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x38e0, lpOverlapped=0x0) returned 1 [0164.907] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0164.922] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0164.925] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.931] CloseHandle (hObject=0x188) returned 1 [0164.932] CloseHandle (hObject=0x1a4) returned 1 [0164.932] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0164.933] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0164.933] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0164.933] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0164.933] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0164.933] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin")) returned 0 [0164.933] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000013.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000013.bin")) returned 0x21 [0164.933] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0164.933] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0164.934] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0164.934] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c44 [0164.934] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0164.934] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0164.941] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0164.983] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x2c44, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x2c44, lpOverlapped=0x0) returned 1 [0164.996] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x2c50, lpOverlapped=0x0) returned 1 [0164.997] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.012] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.022] CloseHandle (hObject=0x1a4) returned 1 [0165.022] CloseHandle (hObject=0x188) returned 1 [0165.022] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.023] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.023] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0165.023] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.023] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0165.023] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin")) returned 0 [0165.023] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000014.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000014.bin")) returned 0x21 [0165.023] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.024] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.024] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.025] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x33b9 [0165.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.025] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.032] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.177] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x33b9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x33b9, lpOverlapped=0x0) returned 1 [0165.180] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x33c0, lpOverlapped=0x0) returned 1 [0165.181] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.202] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.205] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.212] CloseHandle (hObject=0x188) returned 1 [0165.212] CloseHandle (hObject=0x1a4) returned 1 [0165.212] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.215] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.215] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0165.215] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.215] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0165.215] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin")) returned 0 [0165.215] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000015.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000015.bin")) returned 0x21 [0165.215] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.215] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.215] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.222] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x622 [0165.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.223] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.230] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.278] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x622, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x622, lpOverlapped=0x0) returned 1 [0165.287] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x630, lpOverlapped=0x0) returned 1 [0165.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.314] CloseHandle (hObject=0x1a4) returned 1 [0165.314] CloseHandle (hObject=0x188) returned 1 [0165.314] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0165.315] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.315] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0165.315] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin")) returned 0 [0165.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000016.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000016.bin")) returned 0x21 [0165.315] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.316] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.316] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.320] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e6e [0165.320] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.320] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.327] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.371] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x2e6e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x2e6e, lpOverlapped=0x0) returned 1 [0165.510] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x2e70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x2e70, lpOverlapped=0x0) returned 1 [0165.511] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.530] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.537] CloseHandle (hObject=0x188) returned 1 [0165.537] CloseHandle (hObject=0x1a4) returned 1 [0165.537] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.538] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0165.538] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.538] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0165.538] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin")) returned 0 [0165.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000017.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000017.bin")) returned 0x21 [0165.538] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.538] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.539] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.539] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8de [0165.539] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.539] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.547] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.587] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x8de, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x8de, lpOverlapped=0x0) returned 1 [0165.599] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x8e0, lpOverlapped=0x0) returned 1 [0165.600] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.616] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.620] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.626] CloseHandle (hObject=0x1a4) returned 1 [0165.626] CloseHandle (hObject=0x188) returned 1 [0165.627] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.627] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.627] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0165.628] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.628] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0165.628] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin")) returned 0 [0165.628] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000018.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000018.bin")) returned 0x21 [0165.628] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.628] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.629] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.630] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3000 [0165.630] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.630] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.637] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.677] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x3000, lpOverlapped=0x0) returned 1 [0165.687] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x3010, lpOverlapped=0x0) returned 1 [0165.688] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.703] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.707] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.713] CloseHandle (hObject=0x188) returned 1 [0165.714] CloseHandle (hObject=0x1a4) returned 1 [0165.714] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.714] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.715] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0165.715] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.715] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0165.715] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin")) returned 1 [0165.716] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003K.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003k.bin")) returned 0xffffffff [0165.716] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.716] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.716] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.716] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0165.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.717] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.723] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.771] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x2000, lpOverlapped=0x0) returned 1 [0165.772] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x2010, lpOverlapped=0x0) returned 1 [0165.773] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.788] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.792] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.798] CloseHandle (hObject=0x1a4) returned 1 [0165.798] CloseHandle (hObject=0x188) returned 1 [0165.799] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.799] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.799] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0165.799] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.799] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0165.800] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin")) returned 1 [0165.800] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003L.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003l.bin")) returned 0xffffffff [0165.800] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.800] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.801] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.801] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0165.801] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.801] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.809] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.852] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x1000, lpOverlapped=0x0) returned 1 [0165.853] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1010, lpOverlapped=0x0) returned 1 [0165.854] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.869] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.873] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.879] CloseHandle (hObject=0x188) returned 1 [0165.879] CloseHandle (hObject=0x1a4) returned 1 [0165.879] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.880] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.880] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0165.880] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.880] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0165.880] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin")) returned 1 [0165.881] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003M.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003m.bin")) returned 0xffffffff [0165.881] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.881] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.881] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.882] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0165.882] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.882] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.889] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0165.930] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x8000, lpOverlapped=0x0) returned 1 [0165.944] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x8010, lpOverlapped=0x0) returned 1 [0165.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0165.974] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0165.978] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.984] CloseHandle (hObject=0x1a4) returned 1 [0165.984] CloseHandle (hObject=0x188) returned 1 [0165.984] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0165.985] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0165.985] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0165.985] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0165.985] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0165.985] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin")) returned 1 [0165.986] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000003N.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000003n.bin")) returned 0xffffffff [0165.986] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0165.986] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0165.987] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0165.987] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc000 [0165.987] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0165.987] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0165.994] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.035] ReadFile (in: hFile=0x188, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xc000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0xc000, lpOverlapped=0x0) returned 1 [0166.044] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xc010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0xc010, lpOverlapped=0x0) returned 1 [0166.045] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.060] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.063] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.070] CloseHandle (hObject=0x188) returned 1 [0166.070] CloseHandle (hObject=0x1a4) returned 1 [0166.070] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.071] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.071] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0166.071] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0166.071] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0166.071] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin")) returned 1 [0166.072] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\00000048.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\00000048.bin")) returned 0xffffffff [0166.072] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0166.072] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0166.072] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0166.164] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1000 [0166.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.164] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.173] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.214] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0x1000, lpOverlapped=0x0) returned 1 [0166.230] WriteFile (in: hFile=0x188, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0x1010, lpOverlapped=0x0) returned 1 [0166.231] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.245] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.249] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.255] CloseHandle (hObject=0x1a4) returned 1 [0166.255] CloseHandle (hObject=0x188) returned 1 [0166.255] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.256] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.256] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0166.256] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0166.256] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0166.256] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin")) returned 1 [0166.257] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\0000004U.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\onenote\\16.0\\cache\\0000004u.bin")) returned 0xffffffff [0166.257] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0166.258] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0166.258] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\OneNote\\16.0\\cache\\tmp\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534cc0 [0166.258] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0166.258] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0166.258] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0166.258] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0166.258] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0166.258] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.259] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0166.259] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.259] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0166.259] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.259] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5353c0 [0166.259] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.259] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.259] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Outlook\\Gliding\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0166.259] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.259] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.259] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0166.259] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.259] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0166.259] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.259] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\PlayReady\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534ec0 [0166.260] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.260] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.260] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0166.260] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.260] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.260] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\PlayReady\\Internet Explorer\\Desktop\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0166.260] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0166.260] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0166.260] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0166.260] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.260] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0166.260] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.260] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0166.260] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.260] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Publisher\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0166.261] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.261] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.261] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0166.261] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.261] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e80 [0166.261] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.261] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.261] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0166.261] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.261] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\TokenBroker\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x5351c0 [0166.262] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.262] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.262] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\TokenBroker\\Cache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0166.262] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.262] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.262] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.262] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0166.262] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.262] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0166.262] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.263] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0166.263] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.263] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.263] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0166.263] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.263] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.263] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.263] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0166.263] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.263] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0166.263] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.263] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.263] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0166.264] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0166.264] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1 [0166.264] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.264] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.271] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.312] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47080, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesRead=0x19ecac*=0x1, lpOverlapped=0x0) returned 1 [0166.313] WriteFile (in: hFile=0x188, lpBuffer=0x1d47080*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47080*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0166.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.329] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.333] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.340] CloseHandle (hObject=0x19c) returned 1 [0166.340] CloseHandle (hObject=0x188) returned 1 [0166.340] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.340] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.341] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0166.341] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0166.341] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0166.341] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat")) returned 1 [0166.341] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Vault\\UserProfileRoaming\\Latest.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\vault\\userprofileroaming\\latest.dat")) returned 0xffffffff [0166.342] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.342] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0166.342] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.342] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0166.342] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.342] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535380 [0166.342] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.342] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.342] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0166.343] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0166.343] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43580 [0166.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.343] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.350] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.393] ReadFile (in: hFile=0x190, lpBuffer=0x1d47070, nNumberOfBytesToRead=0x43580, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesRead=0x19ef14*=0x43580, lpOverlapped=0x0) returned 1 [0166.417] WriteFile (in: hFile=0x188, lpBuffer=0x1d47070*, nNumberOfBytesToWrite=0x43590, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47070*, lpNumberOfBytesWritten=0x19ef14*=0x43590, lpOverlapped=0x0) returned 1 [0166.421] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.437] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.441] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.448] CloseHandle (hObject=0x190) returned 1 [0166.448] CloseHandle (hObject=0x188) returned 1 [0166.449] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.449] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.449] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0166.449] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0166.449] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0166.450] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat")) returned 1 [0166.452] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Visio\\content16.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\visio\\content16.dat")) returned 0xffffffff [0166.452] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0166.452] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0166.452] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0166.452] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0166.452] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.452] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.452] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\0\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5353c0 [0166.453] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.453] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.453] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0166.453] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.453] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0166.453] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.453] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.454] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0166.454] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.454] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0166.454] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.454] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.454] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0166.455] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0166.455] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61068 [0166.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.455] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.462] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.504] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0x61068, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0x61068, lpOverlapped=0x0) returned 1 [0166.546] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x61070, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0x61070, lpOverlapped=0x0) returned 1 [0166.551] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.567] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.571] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.578] CloseHandle (hObject=0x190) returned 1 [0166.578] CloseHandle (hObject=0x19c) returned 1 [0166.578] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.579] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.579] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0166.579] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0166.579] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0166.579] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 1 [0166.582] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 0xffffffff [0166.582] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0166.582] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0166.582] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0166.582] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534cc0 [0166.583] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.583] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.584] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0166.584] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0166.585] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0166.585] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.586] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.593] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.640] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0166.725] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0166.726] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.760] CloseHandle (hObject=0x19c) returned 1 [0166.760] CloseHandle (hObject=0x190) returned 1 [0166.760] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.761] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.761] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0166.761] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0166.761] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0166.761] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png")) returned 1 [0166.762] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{219D4102-8477-4DA3-B68D-CBEB50436A31}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{219d4102-8477-4da3-b68d-cbeb50436a31}.png")) returned 0xffffffff [0166.762] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.763] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0166.763] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0166.763] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0166.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.764] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.770] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.812] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0166.825] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0166.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.841] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.844] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.851] CloseHandle (hObject=0x190) returned 1 [0166.851] CloseHandle (hObject=0x19c) returned 1 [0166.851] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.852] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.852] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0166.852] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0166.852] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0166.853] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png")) returned 1 [0166.853] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{3142F004-AD96-48E4-B756-4D6F73D1B9C8}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{3142f004-ad96-48e4-b756-4d6f73d1b9c8}.png")) returned 0xffffffff [0166.853] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0166.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0166.855] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0166.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.855] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.862] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.906] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0166.922] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0166.922] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0166.937] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0166.941] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.947] CloseHandle (hObject=0x19c) returned 1 [0166.947] CloseHandle (hObject=0x190) returned 1 [0166.947] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0166.948] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0166.948] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0166.949] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0166.949] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0166.949] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png")) returned 1 [0166.949] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{46F14CBA-A8C3-4AB0-8748-F3A8C35622B4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{46f14cba-a8c3-4ab0-8748-f3a8c35622b4}.png")) returned 0xffffffff [0166.950] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0166.950] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0166.950] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0166.951] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0166.951] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0166.951] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0166.957] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0166.999] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.009] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.010] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.026] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.030] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.036] CloseHandle (hObject=0x190) returned 1 [0167.036] CloseHandle (hObject=0x19c) returned 1 [0167.036] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.037] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.037] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0167.037] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.038] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0167.038] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png")) returned 1 [0167.038] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{5C217167-4731-4AFD-B181-6274E3DFBF25}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{5c217167-4731-4afd-b181-6274e3dfbf25}.png")) returned 0xffffffff [0167.039] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.039] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.039] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.056] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ae6 [0167.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.056] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.063] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.200] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0x1ae6, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0x1ae6, lpOverlapped=0x0) returned 1 [0167.201] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0x1af0, lpOverlapped=0x0) returned 1 [0167.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.216] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.220] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.226] CloseHandle (hObject=0x19c) returned 1 [0167.226] CloseHandle (hObject=0x190) returned 1 [0167.227] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.227] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.227] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0167.227] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.227] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0167.228] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png")) returned 1 [0167.228] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{708686A3-2087-4B70-81FB-7F608AD7F5D4}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{708686a3-2087-4b70-81fb-7f608ad7f5d4}.png")) returned 0xffffffff [0167.228] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.229] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.229] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.230] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.230] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.237] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.279] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.294] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.294] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.309] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.313] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.319] CloseHandle (hObject=0x190) returned 1 [0167.319] CloseHandle (hObject=0x19c) returned 1 [0167.319] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.320] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.320] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534d00 [0167.320] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.320] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0167.320] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png")) returned 1 [0167.321] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A90EDA99-693C-4259-AF53-D06F3BBAEEAB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a90eda99-693c-4259-af53-d06f3bbaeeab}.png")) returned 0xffffffff [0167.321] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.322] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.322] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.322] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.323] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.329] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.371] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.410] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.411] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.428] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.438] CloseHandle (hObject=0x19c) returned 1 [0167.439] CloseHandle (hObject=0x190) returned 1 [0167.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.439] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.440] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0167.440] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.440] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0167.440] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png")) returned 1 [0167.441] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{A95B47FD-465D-4ACE-A006-DCCC9033E6DB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{a95b47fd-465d-4ace-a006-dccc9033e6db}.png")) returned 0xffffffff [0167.441] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.442] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.442] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.458] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.508] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.522] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.523] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.538] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.542] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.548] CloseHandle (hObject=0x190) returned 1 [0167.548] CloseHandle (hObject=0x19c) returned 1 [0167.548] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.549] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.549] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0167.550] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.550] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0167.550] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png")) returned 1 [0167.551] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{AE613841-F649-4CD7-AF4A-2E7B7D99E12E}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{ae613841-f649-4cd7-af4a-2e7b7d99e12e}.png")) returned 0xffffffff [0167.551] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.551] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.551] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.561] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.562] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.568] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.628] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.638] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.653] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.657] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.663] CloseHandle (hObject=0x19c) returned 1 [0167.663] CloseHandle (hObject=0x190) returned 1 [0167.664] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.664] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.664] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0167.664] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.664] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0167.665] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png")) returned 1 [0167.665] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B5D14E8C-339B-4360-B40C-A274F460B417}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b5d14e8c-339b-4360-b40c-a274f460b417}.png")) returned 0xffffffff [0167.665] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.666] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.666] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.685] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.692] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.698] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.759] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.760] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.761] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.778] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.789] CloseHandle (hObject=0x190) returned 1 [0167.790] CloseHandle (hObject=0x19c) returned 1 [0167.790] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.790] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.791] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0167.791] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.791] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0167.791] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png")) returned 1 [0167.792] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{B6815740-F01E-4E9E-AA05-D3CDE47C3DDC}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{b6815740-f01e-4e9e-aa05-d3cde47c3ddc}.png")) returned 0xffffffff [0167.792] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.793] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.793] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.793] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.793] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.794] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.800] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.843] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.862] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.887] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.897] CloseHandle (hObject=0x19c) returned 1 [0167.897] CloseHandle (hObject=0x190) returned 1 [0167.898] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0167.898] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0167.899] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0167.899] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0167.899] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0167.899] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png")) returned 1 [0167.900] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{C20F58C1-CDD0-45F9-9954-BDF0782633CB}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{c20f58c1-cdd0-45f9-9954-bdf0782633cb}.png")) returned 0xffffffff [0167.900] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0167.900] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0167.901] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0167.902] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa42 [0167.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0167.902] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0167.909] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0167.951] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a0, nNumberOfBytesToRead=0xa42, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesRead=0x19ecac*=0xa42, lpOverlapped=0x0) returned 1 [0167.970] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a0*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470a0*, lpNumberOfBytesWritten=0x19ecac*=0xa50, lpOverlapped=0x0) returned 1 [0167.971] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0167.986] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0167.989] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.025] CloseHandle (hObject=0x190) returned 1 [0168.025] CloseHandle (hObject=0x19c) returned 1 [0168.025] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.026] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0168.026] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0168.026] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0168.026] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0168.026] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png")) returned 1 [0168.027] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\ActionCenterCache\\{D1CC3A2E-2BC2-4715-AD4C-90B4CA0868C0}.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\actioncentercache\\{d1cc3a2e-2bc2-4715-ad4c-90b4ca0868c0}.png")) returned 0xffffffff [0168.027] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0168.027] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0168.027] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0168.027] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0168.028] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.028] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.028] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0168.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0168.032] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0168.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0168.032] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0168.039] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0168.201] WriteFile (in: hFile=0x190, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0168.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0168.217] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0168.220] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.227] CloseHandle (hObject=0x19c) returned 1 [0168.227] CloseHandle (hObject=0x190) returned 1 [0168.227] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.228] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0168.228] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0168.228] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0168.228] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0168.228] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat")) returned 1 [0168.229] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\container.dat")) returned 0xffffffff [0168.256] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.256] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0168.256] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.256] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.256] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0168.256] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0168.257] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0168.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0168.257] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0168.264] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0168.314] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0168.315] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0168.330] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0168.333] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.343] CloseHandle (hObject=0x19c) returned 1 [0168.343] CloseHandle (hObject=0x1a4) returned 1 [0168.343] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.344] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0168.344] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0168.344] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0168.344] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0168.344] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat")) returned 1 [0168.344] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\AppCache\\YGIEUWA9\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\appcache\\ygieuwa9\\container.dat")) returned 0xffffffff [0168.344] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0168.345] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0168.345] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0168.345] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0168.345] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0168.345] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535080 [0168.345] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.359] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.359] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0168.359] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0168.360] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0168.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0168.360] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0168.367] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0168.413] ReadFile (in: hFile=0x190, lpBuffer=0x1d47084, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesRead=0x19ecac*=0xae, lpOverlapped=0x0) returned 1 [0168.413] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47084*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47084*, lpNumberOfBytesWritten=0x19ecac*=0xb0, lpOverlapped=0x0) returned 1 [0168.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0168.429] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0168.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.439] CloseHandle (hObject=0x190) returned 1 [0168.439] CloseHandle (hObject=0x1a4) returned 1 [0168.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0168.440] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0168.440] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0168.440] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0168.440] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini")) returned 1 [0168.441] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\desktop.ini")) returned 0xffffffff [0168.441] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.441] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0168.443] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.443] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.443] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0168.443] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0168.444] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x548 [0168.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0168.444] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0168.451] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0168.496] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a4, nNumberOfBytesToRead=0x548, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesRead=0x19ea44*=0x548, lpOverlapped=0x0) returned 1 [0168.518] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a4*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesWritten=0x19ea44*=0x550, lpOverlapped=0x0) returned 1 [0168.519] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0168.534] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0168.538] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.570] CloseHandle (hObject=0x190) returned 1 [0168.570] CloseHandle (hObject=0x19c) returned 1 [0168.570] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.570] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0168.571] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0168.571] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0168.571] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0168.571] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk")) returned 1 [0168.571] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.3DBuilder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.3dbuilder_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0168.572] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0168.572] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0168.572] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.572] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0168.577] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.577] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.577] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0168.578] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0168.578] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x481 [0168.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0168.579] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0168.585] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0168.640] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x481, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ea44*=0x481, lpOverlapped=0x0) returned 1 [0168.760] WriteFile (in: hFile=0x190, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ea44*=0x490, lpOverlapped=0x0) returned 1 [0168.761] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0168.777] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0168.780] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.787] CloseHandle (hObject=0x19c) returned 1 [0168.787] CloseHandle (hObject=0x190) returned 1 [0168.787] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.788] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0168.788] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0168.788] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0168.789] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0168.789] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk")) returned 1 [0168.789] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0168.789] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0168.789] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0168.790] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.790] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0168.791] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.791] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0168.791] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0168.791] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0168.792] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x441 [0168.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0168.792] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0168.798] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0168.890] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x441, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x441, lpOverlapped=0x0) returned 1 [0168.932] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x450, lpOverlapped=0x0) returned 1 [0168.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0168.950] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0168.954] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.960] CloseHandle (hObject=0x190) returned 1 [0168.960] CloseHandle (hObject=0x19c) returned 1 [0168.960] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0168.961] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0168.961] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0168.961] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0168.961] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0168.961] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk")) returned 1 [0168.962] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.AccountsControl_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.accountscontrol_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0168.962] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0168.962] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0168.962] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0168.962] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0169.001] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.001] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.001] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0169.001] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0169.045] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x469 [0169.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0169.045] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0169.052] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0169.205] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x469, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x469, lpOverlapped=0x0) returned 1 [0169.222] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x470, lpOverlapped=0x0) returned 1 [0169.222] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0169.238] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0169.242] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.249] CloseHandle (hObject=0x19c) returned 1 [0169.249] CloseHandle (hObject=0x190) returned 1 [0169.249] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0169.250] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0169.250] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0169.250] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0169.250] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0169.250] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk")) returned 1 [0169.251] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Appconnector_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.appconnector_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0169.251] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0169.251] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0169.251] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0169.251] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0169.322] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.322] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.322] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0169.324] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0169.324] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c4 [0169.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0169.325] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0169.333] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0169.393] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b0, nNumberOfBytesToRead=0x5c4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesRead=0x19ea44*=0x5c4, lpOverlapped=0x0) returned 1 [0169.395] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b0*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesWritten=0x19ea44*=0x5d0, lpOverlapped=0x0) returned 1 [0169.396] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0169.418] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0169.423] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.433] CloseHandle (hObject=0x190) returned 1 [0169.433] CloseHandle (hObject=0x19c) returned 1 [0169.433] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0169.435] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0169.435] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0169.435] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0169.435] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0169.435] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk")) returned 1 [0169.436] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingFinance_8wekyb3d8bbwe\\AppexFinance.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingfinance_8wekyb3d8bbwe\\appexfinance.lnk")) returned 0xffffffff [0169.436] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0169.436] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0169.437] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0169.437] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0169.440] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.440] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0169.442] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0169.444] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a0 [0169.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0169.444] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0169.455] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0169.517] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x5a0, lpOverlapped=0x0) returned 1 [0169.519] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x5b0, lpOverlapped=0x0) returned 1 [0169.520] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0169.541] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0169.545] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.554] CloseHandle (hObject=0x19c) returned 1 [0169.554] CloseHandle (hObject=0x190) returned 1 [0169.554] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0169.555] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0169.555] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0169.555] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0169.555] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0169.555] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk")) returned 1 [0169.556] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingNews_8wekyb3d8bbwe\\AppexNews.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingnews_8wekyb3d8bbwe\\appexnews.lnk")) returned 0xffffffff [0169.556] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0169.556] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0169.556] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0169.556] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0169.690] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.690] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.690] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0169.691] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0169.691] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d8 [0169.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0169.692] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0169.698] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0169.757] ReadFile (in: hFile=0x190, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x5d8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ea44*=0x5d8, lpOverlapped=0x0) returned 1 [0169.797] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ea44*=0x5e0, lpOverlapped=0x0) returned 1 [0169.797] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0169.816] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0169.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.829] CloseHandle (hObject=0x190) returned 1 [0169.829] CloseHandle (hObject=0x19c) returned 1 [0169.829] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0169.830] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0169.830] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0169.830] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0169.830] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0169.841] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk")) returned 1 [0169.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingSports_8wekyb3d8bbwe\\AppexSports.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingsports_8wekyb3d8bbwe\\appexsports.lnk")) returned 0xffffffff [0169.842] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0169.842] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0169.843] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0169.843] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0169.844] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.844] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.844] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0169.845] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0169.846] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d4 [0169.846] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0169.846] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0169.854] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0169.899] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a4, nNumberOfBytesToRead=0x5d4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesRead=0x19ea44*=0x5d4, lpOverlapped=0x0) returned 1 [0169.913] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a4*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesWritten=0x19ea44*=0x5e0, lpOverlapped=0x0) returned 1 [0169.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0169.930] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0169.934] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.942] CloseHandle (hObject=0x19c) returned 1 [0169.942] CloseHandle (hObject=0x190) returned 1 [0169.942] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0169.943] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0169.943] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0169.943] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0169.943] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0169.943] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk")) returned 1 [0169.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BingWeather_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bingweather_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0169.944] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0169.944] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0169.944] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0169.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0169.954] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.954] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0169.954] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0169.954] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0169.955] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x441 [0169.955] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0169.955] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0169.962] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.004] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x441, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x441, lpOverlapped=0x0) returned 1 [0170.006] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x450, lpOverlapped=0x0) returned 1 [0170.007] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.022] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.026] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.032] CloseHandle (hObject=0x190) returned 1 [0170.032] CloseHandle (hObject=0x19c) returned 1 [0170.032] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.033] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.033] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0170.033] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.033] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0170.033] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk")) returned 1 [0170.034] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.BioEnrollment_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.bioenrollment_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0170.034] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.034] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0170.034] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.034] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0170.036] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.036] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.036] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.037] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.038] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x538 [0170.038] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.038] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.045] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.089] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a4, nNumberOfBytesToRead=0x538, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesRead=0x19ea44*=0x538, lpOverlapped=0x0) returned 1 [0170.112] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a4*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesWritten=0x19ea44*=0x540, lpOverlapped=0x0) returned 1 [0170.113] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.198] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.210] CloseHandle (hObject=0x19c) returned 1 [0170.210] CloseHandle (hObject=0x190) returned 1 [0170.210] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.211] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0170.211] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.211] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0170.211] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk")) returned 1 [0170.212] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Getstarted_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.getstarted_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0170.212] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.212] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0170.212] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.212] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0170.230] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.230] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.231] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.232] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.232] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43d [0170.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.233] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.240] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.298] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b8, nNumberOfBytesToRead=0x43d, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesRead=0x19ea44*=0x43d, lpOverlapped=0x0) returned 1 [0170.313] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b8*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesWritten=0x19ea44*=0x440, lpOverlapped=0x0) returned 1 [0170.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.328] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.335] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.344] CloseHandle (hObject=0x190) returned 1 [0170.345] CloseHandle (hObject=0x19c) returned 1 [0170.345] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.346] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.346] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0170.346] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.346] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0170.346] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk")) returned 1 [0170.347] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.LockApp_cw5n1h2txyewy\\WindowsDefaultLockScreen.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.lockapp_cw5n1h2txyewy\\windowsdefaultlockscreen.lnk")) returned 0xffffffff [0170.348] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.348] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0170.348] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.348] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0170.376] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.376] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.377] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.377] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.378] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x574 [0170.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.378] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.384] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.443] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b0, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesRead=0x19ea44*=0x574, lpOverlapped=0x0) returned 1 [0170.462] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b0*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesWritten=0x19ea44*=0x580, lpOverlapped=0x0) returned 1 [0170.462] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.478] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.482] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.489] CloseHandle (hObject=0x19c) returned 1 [0170.490] CloseHandle (hObject=0x190) returned 1 [0170.490] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.490] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.490] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0170.491] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.491] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0170.491] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk")) returned 1 [0170.491] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\MicrosoftEdge.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoftedge.lnk")) returned 0xffffffff [0170.492] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.492] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0170.492] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.492] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0170.516] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.516] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.517] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.517] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.518] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ac [0170.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.518] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.525] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.573] ReadFile (in: hFile=0x190, lpBuffer=0x1d470c4, nNumberOfBytesToRead=0x5ac, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesRead=0x19ea44*=0x5ac, lpOverlapped=0x0) returned 1 [0170.599] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470c4*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesWritten=0x19ea44*=0x5b0, lpOverlapped=0x0) returned 1 [0170.600] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.618] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.622] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.629] CloseHandle (hObject=0x190) returned 1 [0170.629] CloseHandle (hObject=0x19c) returned 1 [0170.629] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.630] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.630] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0170.630] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.630] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0170.630] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk")) returned 1 [0170.632] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub.lnk")) returned 0xffffffff [0170.632] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.632] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0170.632] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.632] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0170.636] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.636] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.637] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.638] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69c [0170.638] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.638] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.657] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.736] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b8, nNumberOfBytesToRead=0x69c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesRead=0x19ea44*=0x69c, lpOverlapped=0x0) returned 1 [0170.752] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesWritten=0x19ea44*=0x6a0, lpOverlapped=0x0) returned 1 [0170.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.779] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.784] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.794] CloseHandle (hObject=0x19c) returned 1 [0170.794] CloseHandle (hObject=0x190) returned 1 [0170.795] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.795] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.796] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0170.796] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.796] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0170.796] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk")) returned 1 [0170.797] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0170.797] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.797] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0170.797] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.797] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0170.806] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.806] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.806] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.806] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.807] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x534 [0170.807] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.808] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.874] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b8, nNumberOfBytesToRead=0x534, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesRead=0x19ea44*=0x534, lpOverlapped=0x0) returned 1 [0170.881] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesWritten=0x19ea44*=0x540, lpOverlapped=0x0) returned 1 [0170.882] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0170.903] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0170.908] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.928] CloseHandle (hObject=0x190) returned 1 [0170.928] CloseHandle (hObject=0x19c) returned 1 [0170.929] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0170.930] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0170.930] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0170.930] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0170.930] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0170.930] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk")) returned 1 [0170.932] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.onenoteim.lnk")) returned 0xffffffff [0170.932] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0170.932] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0170.932] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0170.936] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0170.939] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.939] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0170.939] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0170.940] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0170.941] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c9 [0170.941] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0170.941] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0170.948] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0170.994] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470c4, nNumberOfBytesToRead=0x5c9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesRead=0x19ea44*=0x5c9, lpOverlapped=0x0) returned 1 [0171.004] WriteFile (in: hFile=0x190, lpBuffer=0x1d470c4*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesWritten=0x19ea44*=0x5d0, lpOverlapped=0x0) returned 1 [0171.005] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.026] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.030] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.039] CloseHandle (hObject=0x19c) returned 1 [0171.039] CloseHandle (hObject=0x190) returned 1 [0171.040] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.041] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.041] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0171.041] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.041] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0171.041] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk")) returned 1 [0171.042] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.People_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.people_8wekyb3d8bbwe\\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.lnk")) returned 0xffffffff [0171.042] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.042] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0171.042] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.042] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0171.042] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.042] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.043] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.044] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.044] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x524 [0171.044] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.045] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.053] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.097] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a4, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesRead=0x19ea44*=0x524, lpOverlapped=0x0) returned 1 [0171.216] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a4*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesWritten=0x19ea44*=0x530, lpOverlapped=0x0) returned 1 [0171.217] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.232] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.236] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.243] CloseHandle (hObject=0x190) returned 1 [0171.243] CloseHandle (hObject=0x19c) returned 1 [0171.243] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.244] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.244] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0171.244] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.244] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0171.244] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk")) returned 1 [0171.245] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.SkypeApp_kzf8qxf38zg5c\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.skypeapp_kzf8qxf38zg5c\\app.lnk")) returned 0xffffffff [0171.245] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.245] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0171.245] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.245] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0171.246] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.246] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.246] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.247] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.247] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e5 [0171.247] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.248] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.254] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.297] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b8, nNumberOfBytesToRead=0x4e5, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesRead=0x19ea44*=0x4e5, lpOverlapped=0x0) returned 1 [0171.298] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b8*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesWritten=0x19ea44*=0x4f0, lpOverlapped=0x0) returned 1 [0171.298] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.315] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.318] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.325] CloseHandle (hObject=0x19c) returned 1 [0171.325] CloseHandle (hObject=0x190) returned 1 [0171.325] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.326] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.326] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0171.326] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.326] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0171.326] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk")) returned 1 [0171.327] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0171.327] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.327] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0171.327] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.327] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0171.328] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.328] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.328] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.328] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.329] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c1 [0171.329] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.330] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.337] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.379] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b4, nNumberOfBytesToRead=0x4c1, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesRead=0x19ea44*=0x4c1, lpOverlapped=0x0) returned 1 [0171.380] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b4*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesWritten=0x19ea44*=0x4d0, lpOverlapped=0x0) returned 1 [0171.381] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.396] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.400] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.408] CloseHandle (hObject=0x190) returned 1 [0171.408] CloseHandle (hObject=0x19c) returned 1 [0171.408] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.409] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.409] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0171.409] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.410] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0171.410] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk")) returned 1 [0171.410] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0171.410] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.411] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0171.411] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.411] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0171.411] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.411] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.411] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.411] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.412] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51a [0171.412] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.412] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.420] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.462] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b8, nNumberOfBytesToRead=0x51a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesRead=0x19ea44*=0x51a, lpOverlapped=0x0) returned 1 [0171.463] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b8*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b8*, lpNumberOfBytesWritten=0x19ea44*=0x520, lpOverlapped=0x0) returned 1 [0171.464] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.479] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.483] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.489] CloseHandle (hObject=0x19c) returned 1 [0171.490] CloseHandle (hObject=0x190) returned 1 [0171.490] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.491] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.491] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0171.491] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.491] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0171.491] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk")) returned 1 [0171.492] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0171.492] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.492] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0171.492] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.492] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0171.523] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.523] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.523] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.523] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.524] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ff [0171.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.524] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.531] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.575] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b0, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesRead=0x19ea44*=0x4ff, lpOverlapped=0x0) returned 1 [0171.611] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b0*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesWritten=0x19ea44*=0x500, lpOverlapped=0x0) returned 1 [0171.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.627] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.631] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.638] CloseHandle (hObject=0x190) returned 1 [0171.638] CloseHandle (hObject=0x19c) returned 1 [0171.639] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.639] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.639] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0171.639] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.640] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0171.640] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk")) returned 1 [0171.640] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\CortanaUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.cortana_cw5n1h2txyewy\\cortanaui.lnk")) returned 0xffffffff [0171.641] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.641] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0171.641] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.641] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0171.641] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.641] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.642] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.642] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47d [0171.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.642] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.650] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.697] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b4, nNumberOfBytesToRead=0x47d, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesRead=0x19ea44*=0x47d, lpOverlapped=0x0) returned 1 [0171.698] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b4*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesWritten=0x19ea44*=0x480, lpOverlapped=0x0) returned 1 [0171.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.715] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.719] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.726] CloseHandle (hObject=0x19c) returned 1 [0171.727] CloseHandle (hObject=0x190) returned 1 [0171.727] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.727] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.728] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0171.728] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.728] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0171.728] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk")) returned 1 [0171.729] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0171.729] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.729] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0171.729] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.729] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0171.730] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.730] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.730] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.731] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.732] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554 [0171.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.732] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.739] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.789] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x554, lpOverlapped=0x0) returned 1 [0171.809] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x560, lpOverlapped=0x0) returned 1 [0171.810] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.826] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.830] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.837] CloseHandle (hObject=0x190) returned 1 [0171.837] CloseHandle (hObject=0x19c) returned 1 [0171.838] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.838] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.838] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0171.839] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.839] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0171.839] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk")) returned 1 [0171.839] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.photos_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0171.840] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.840] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0171.840] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.840] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0171.840] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.840] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.840] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.840] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.841] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x495 [0171.841] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.841] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.848] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0171.890] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b4, nNumberOfBytesToRead=0x495, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesRead=0x19ea44*=0x495, lpOverlapped=0x0) returned 1 [0171.922] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b4*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesWritten=0x19ea44*=0x4a0, lpOverlapped=0x0) returned 1 [0171.939] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0171.954] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0171.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.965] CloseHandle (hObject=0x19c) returned 1 [0171.965] CloseHandle (hObject=0x190) returned 1 [0171.966] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0171.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0171.966] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0171.966] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0171.967] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0171.967] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk")) returned 1 [0171.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0171.967] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0171.967] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0171.968] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0171.968] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0171.968] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.968] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0171.968] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0171.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0171.969] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f8 [0171.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0171.970] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0171.977] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.021] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x4f8, lpOverlapped=0x0) returned 1 [0172.030] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x500, lpOverlapped=0x0) returned 1 [0172.031] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.049] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.053] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.061] CloseHandle (hObject=0x190) returned 1 [0172.061] CloseHandle (hObject=0x19c) returned 1 [0172.061] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.062] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.062] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0172.062] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.062] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0172.062] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk")) returned 1 [0172.063] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsalarms_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0172.063] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0172.063] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0172.063] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0172.063] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534cc0 [0172.063] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.063] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.063] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.063] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.064] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x574 [0172.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.064] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.072] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.118] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x574, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ea44*=0x574, lpOverlapped=0x0) returned 1 [0172.131] WriteFile (in: hFile=0x190, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ea44*=0x580, lpOverlapped=0x0) returned 1 [0172.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.149] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.153] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.163] CloseHandle (hObject=0x19c) returned 1 [0172.163] CloseHandle (hObject=0x190) returned 1 [0172.202] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.206] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.206] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0172.206] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.206] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0172.206] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk")) returned 1 [0172.207] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscalculator_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0172.207] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0172.207] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0172.207] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0172.207] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0172.208] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.208] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.209] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.209] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.210] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61c [0172.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.211] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.219] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.267] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x61c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x61c, lpOverlapped=0x0) returned 1 [0172.288] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x620, lpOverlapped=0x0) returned 1 [0172.289] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.304] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.308] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.316] CloseHandle (hObject=0x190) returned 1 [0172.316] CloseHandle (hObject=0x19c) returned 1 [0172.316] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.317] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.318] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0172.318] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.318] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0172.318] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk")) returned 1 [0172.319] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscamera_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0172.319] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0172.319] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0172.319] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0172.319] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0172.321] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.321] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.321] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.321] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.322] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x781 [0172.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.322] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.329] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.373] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470d0, nNumberOfBytesToRead=0x781, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470d0*, lpNumberOfBytesRead=0x19ea44*=0x781, lpOverlapped=0x0) returned 1 [0172.411] WriteFile (in: hFile=0x190, lpBuffer=0x1d470d0*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470d0*, lpNumberOfBytesWritten=0x19ea44*=0x790, lpOverlapped=0x0) returned 1 [0172.412] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.428] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.438] CloseHandle (hObject=0x19c) returned 1 [0172.438] CloseHandle (hObject=0x190) returned 1 [0172.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.439] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.439] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0172.440] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.440] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0172.440] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk")) returned 1 [0172.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.calendar.lnk")) returned 0xffffffff [0172.440] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.442] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x739 [0172.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.442] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.480] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.521] ReadFile (in: hFile=0x190, lpBuffer=0x1d470cc, nNumberOfBytesToRead=0x739, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470cc*, lpNumberOfBytesRead=0x19ea44*=0x739, lpOverlapped=0x0) returned 1 [0172.571] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470cc*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470cc*, lpNumberOfBytesWritten=0x19ea44*=0x740, lpOverlapped=0x0) returned 1 [0172.572] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.588] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.598] CloseHandle (hObject=0x190) returned 1 [0172.598] CloseHandle (hObject=0x19c) returned 1 [0172.598] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.599] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.599] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0172.599] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.599] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0172.599] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk")) returned 1 [0172.600] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowslive.mail.lnk")) returned 0xffffffff [0172.600] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0172.600] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0172.600] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0172.601] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0172.601] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.601] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.602] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.602] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.602] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x584 [0172.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.603] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.609] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.650] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x584, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x584, lpOverlapped=0x0) returned 1 [0172.711] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x590, lpOverlapped=0x0) returned 1 [0172.712] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.730] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.734] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.741] CloseHandle (hObject=0x19c) returned 1 [0172.741] CloseHandle (hObject=0x190) returned 1 [0172.747] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.747] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0172.748] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.748] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0172.748] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk")) returned 1 [0172.749] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsfeedback_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0172.749] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0172.749] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0172.749] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0172.749] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0172.749] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.750] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.750] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.750] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.751] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554 [0172.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.751] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.758] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.799] ReadFile (in: hFile=0x190, lpBuffer=0x1d470a4, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesRead=0x19ea44*=0x554, lpOverlapped=0x0) returned 1 [0172.854] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470a4*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a4*, lpNumberOfBytesWritten=0x19ea44*=0x560, lpOverlapped=0x0) returned 1 [0172.855] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0172.870] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0172.874] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.880] CloseHandle (hObject=0x190) returned 1 [0172.880] CloseHandle (hObject=0x19c) returned 1 [0172.881] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0172.881] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0172.881] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0172.881] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0172.881] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0172.881] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk")) returned 1 [0172.883] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsmaps_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0172.883] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0172.883] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0172.883] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0172.883] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0172.930] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.930] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0172.930] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0172.930] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0172.931] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bf [0172.931] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0172.931] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0172.938] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0172.981] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b4, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesRead=0x19ea44*=0x4bf, lpOverlapped=0x0) returned 1 [0173.002] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b4*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesWritten=0x19ea44*=0x4c0, lpOverlapped=0x0) returned 1 [0173.003] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.018] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.021] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.028] CloseHandle (hObject=0x19c) returned 1 [0173.028] CloseHandle (hObject=0x190) returned 1 [0173.028] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.029] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.029] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0173.029] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.029] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0173.029] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk")) returned 1 [0173.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\CompanionApp.App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsphone_8wekyb3d8bbwe\\companionapp.app.lnk")) returned 0xffffffff [0173.030] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.030] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0173.030] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.030] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0173.030] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.030] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0173.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0173.031] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c0 [0173.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0173.032] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0173.039] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0173.079] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b0, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesRead=0x19ea44*=0x5c0, lpOverlapped=0x0) returned 1 [0173.100] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b0*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesWritten=0x19ea44*=0x5d0, lpOverlapped=0x0) returned 1 [0173.100] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.116] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.120] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.126] CloseHandle (hObject=0x190) returned 1 [0173.126] CloseHandle (hObject=0x19c) returned 1 [0173.126] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.127] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.127] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0173.127] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.127] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0173.127] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk")) returned 1 [0173.128] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0173.128] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.128] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0173.128] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0173.129] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.129] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.129] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0173.130] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0173.130] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x551 [0173.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0173.131] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0173.137] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0173.207] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x551, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x551, lpOverlapped=0x0) returned 1 [0173.235] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x560, lpOverlapped=0x0) returned 1 [0173.236] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.259] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.264] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.273] CloseHandle (hObject=0x19c) returned 1 [0173.273] CloseHandle (hObject=0x190) returned 1 [0173.273] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.274] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.274] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0173.274] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.274] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0173.274] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk")) returned 1 [0173.275] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.WindowsStore_8wekyb3d8bbwe\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.windowsstore_8wekyb3d8bbwe\\app.lnk")) returned 0xffffffff [0173.275] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.275] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0173.275] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.275] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535000 [0173.321] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.321] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.321] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0173.322] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0173.323] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x508 [0173.323] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0173.324] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0173.331] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0173.375] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b0, nNumberOfBytesToRead=0x508, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesRead=0x19ea44*=0x508, lpOverlapped=0x0) returned 1 [0173.415] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b0*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b0*, lpNumberOfBytesWritten=0x19ea44*=0x510, lpOverlapped=0x0) returned 1 [0173.416] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.433] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.437] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.443] CloseHandle (hObject=0x190) returned 1 [0173.444] CloseHandle (hObject=0x19c) returned 1 [0173.444] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.445] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.445] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0173.445] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.445] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0173.445] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk")) returned 1 [0173.446] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp.lnk")) returned 0xffffffff [0173.446] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.446] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0173.446] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.446] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0173.473] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.473] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.474] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0173.474] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0173.475] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x479 [0173.475] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0173.475] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0173.482] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0173.526] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470c4, nNumberOfBytesToRead=0x479, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesRead=0x19ea44*=0x479, lpOverlapped=0x0) returned 1 [0173.632] WriteFile (in: hFile=0x190, lpBuffer=0x1d470c4*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesWritten=0x19ea44*=0x480, lpOverlapped=0x0) returned 1 [0173.633] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.648] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.658] CloseHandle (hObject=0x19c) returned 1 [0173.658] CloseHandle (hObject=0x190) returned 1 [0173.658] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.659] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.659] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0173.659] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.659] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0173.660] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk")) returned 1 [0173.660] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui.lnk")) returned 0xffffffff [0173.660] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.660] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0173.660] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0173.739] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.739] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.740] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0173.740] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0173.748] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b5 [0173.748] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0173.748] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0173.755] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0173.798] ReadFile (in: hFile=0x190, lpBuffer=0x1d470c8, nNumberOfBytesToRead=0x4b5, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c8*, lpNumberOfBytesRead=0x19ea44*=0x4b5, lpOverlapped=0x0) returned 1 [0173.806] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470c8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c8*, lpNumberOfBytesWritten=0x19ea44*=0x4c0, lpOverlapped=0x0) returned 1 [0173.807] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.822] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.833] CloseHandle (hObject=0x190) returned 1 [0173.833] CloseHandle (hObject=0x19c) returned 1 [0173.833] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.834] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.834] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0173.835] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.835] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0173.835] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk")) returned 1 [0173.836] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider.lnk")) returned 0xffffffff [0173.836] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.836] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0173.836] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.836] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0173.856] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.856] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0173.856] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0173.857] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0173.858] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d4 [0173.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0173.858] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0173.865] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0173.907] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470b4, nNumberOfBytesToRead=0x5d4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesRead=0x19ea44*=0x5d4, lpOverlapped=0x0) returned 1 [0173.962] WriteFile (in: hFile=0x190, lpBuffer=0x1d470b4*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesWritten=0x19ea44*=0x5e0, lpOverlapped=0x0) returned 1 [0173.963] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0173.981] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0173.986] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.996] CloseHandle (hObject=0x19c) returned 1 [0173.996] CloseHandle (hObject=0x190) returned 1 [0173.996] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0173.997] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0173.997] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0173.998] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0173.998] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0173.998] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk")) returned 1 [0173.999] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic.lnk")) returned 0xffffffff [0173.999] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0173.999] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0173.999] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0173.999] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0174.110] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.110] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.110] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0174.111] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.112] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x528 [0174.112] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.112] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.119] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.162] ReadFile (in: hFile=0x190, lpBuffer=0x1d470b4, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesRead=0x19ea44*=0x528, lpOverlapped=0x0) returned 1 [0174.224] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470b4*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470b4*, lpNumberOfBytesWritten=0x19ea44*=0x530, lpOverlapped=0x0) returned 1 [0174.225] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.240] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.244] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.251] CloseHandle (hObject=0x190) returned 1 [0174.251] CloseHandle (hObject=0x19c) returned 1 [0174.251] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.252] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.252] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0174.252] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0174.252] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0174.253] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk")) returned 1 [0174.254] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo.lnk")) returned 0xffffffff [0174.254] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0174.254] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0174.254] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.254] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0174.254] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.254] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0174.256] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e0 [0174.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.256] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.263] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.308] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470a8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesRead=0x19ea44*=0x4e0, lpOverlapped=0x0) returned 1 [0174.408] WriteFile (in: hFile=0x190, lpBuffer=0x1d470a8*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470a8*, lpNumberOfBytesWritten=0x19ea44*=0x4f0, lpOverlapped=0x0) returned 1 [0174.409] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.425] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.428] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.435] CloseHandle (hObject=0x19c) returned 1 [0174.436] CloseHandle (hObject=0x190) returned 1 [0174.436] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.436] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.437] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0174.437] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0174.437] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0174.437] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk")) returned 1 [0174.437] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.ContactSupport_cw5n1h2txyewy\\App.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.contactsupport_cw5n1h2txyewy\\app.lnk")) returned 0xffffffff [0174.438] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0174.438] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0174.438] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.438] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0174.464] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.464] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.464] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0174.464] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.465] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x435 [0174.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.465] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.472] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.514] ReadFile (in: hFile=0x190, lpBuffer=0x1d470c4, nNumberOfBytesToRead=0x435, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesRead=0x19ea44*=0x435, lpOverlapped=0x0) returned 1 [0174.515] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470c4*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d470c4*, lpNumberOfBytesWritten=0x19ea44*=0x440, lpOverlapped=0x0) returned 1 [0174.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.531] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.535] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.541] CloseHandle (hObject=0x190) returned 1 [0174.542] CloseHandle (hObject=0x19c) returned 1 [0174.542] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.543] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.543] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0174.543] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0174.543] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0174.543] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk")) returned 1 [0174.544] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Application Shortcuts\\Windows.PurchaseDialog_cw5n1h2txyewy\\Microsoft.Windows.PurchaseDialog.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\application shortcuts\\windows.purchasedialog_cw5n1h2txyewy\\microsoft.windows.purchasedialog.lnk")) returned 0xffffffff [0174.544] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0174.544] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0174.544] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0174.544] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0174.544] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0174.544] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0174.544] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.544] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.544] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0174.544] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.544] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.545] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0174.545] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0174.545] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.546] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.552] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.596] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47078, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesRead=0x19ea44*=0xae, lpOverlapped=0x0) returned 1 [0174.596] WriteFile (in: hFile=0x190, lpBuffer=0x1d47078*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0174.597] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.613] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.616] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.623] CloseHandle (hObject=0x19c) returned 1 [0174.623] CloseHandle (hObject=0x190) returned 1 [0174.623] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.625] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0174.625] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0174.625] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0174.625] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0174.626] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0174.626] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0174.626] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0174.626] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.626] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0174.626] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.626] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0174.627] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0174.627] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.627] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0174.627] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.627] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.634] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.675] ReadFile (in: hFile=0x190, lpBuffer=0x1d4707c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesRead=0x19ea44*=0xae, lpOverlapped=0x0) returned 1 [0174.676] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4707c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4707c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0174.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.692] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.696] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.703] CloseHandle (hObject=0x190) returned 1 [0174.703] CloseHandle (hObject=0x19c) returned 1 [0174.703] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.704] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.704] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0174.704] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0174.704] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0174.704] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 1 [0174.705] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0xffffffff [0174.705] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0174.705] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0174.705] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0174.706] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0174.706] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0174.706] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535400 [0174.706] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.706] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0174.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.707] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0174.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.707] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.714] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.761] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47078, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesRead=0x19ecac*=0x4000, lpOverlapped=0x0) returned 1 [0174.762] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47078*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesWritten=0x19ecac*=0x4010, lpOverlapped=0x0) returned 1 [0174.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.778] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.782] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.788] CloseHandle (hObject=0x1a4) returned 1 [0174.788] CloseHandle (hObject=0x19c) returned 1 [0174.788] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.790] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.790] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0174.790] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0174.790] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0174.790] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0 [0174.791] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0x20 [0174.791] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.791] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.791] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0174.791] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0174.791] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.792] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.798] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.842] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47078, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesRead=0x19ecac*=0x4000, lpOverlapped=0x0) returned 1 [0174.843] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47078*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47078*, lpNumberOfBytesWritten=0x19ecac*=0x4010, lpOverlapped=0x0) returned 1 [0174.844] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.860] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.864] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.872] CloseHandle (hObject=0x19c) returned 1 [0174.872] CloseHandle (hObject=0x1a4) returned 1 [0174.872] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0174.873] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0174.873] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0174.873] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0174.873] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0174.873] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db")) returned 0 [0174.873] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.3.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.3.db")) returned 0x20 [0174.873] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0174.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0174.874] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0174.887] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61088 [0174.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0174.888] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0174.895] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0174.941] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x61088, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0x61088, lpOverlapped=0x0) returned 1 [0174.968] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x61090, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0x61090, lpOverlapped=0x0) returned 1 [0174.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0174.989] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0174.993] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.000] CloseHandle (hObject=0x1a4) returned 1 [0175.000] CloseHandle (hObject=0x19c) returned 1 [0175.000] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.001] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.001] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0175.001] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.001] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0175.001] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db")) returned 1 [0175.004] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{2546D910-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{2546d910-b905-4d30-88c9-b63c603da134}.3.ver0x0000000000000001.db")) returned 0xffffffff [0175.004] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.005] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.005] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.005] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c240 [0175.005] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.006] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.014] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.057] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x1c240, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0x1c240, lpOverlapped=0x0) returned 1 [0175.060] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x1c250, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0x1c250, lpOverlapped=0x0) returned 1 [0175.061] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.079] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.094] CloseHandle (hObject=0x19c) returned 1 [0175.094] CloseHandle (hObject=0x1a4) returned 1 [0175.094] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.095] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.096] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0175.096] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.096] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0175.096] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db")) returned 0 [0175.096] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000039.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000039.db")) returned 0x20 [0175.096] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.097] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.097] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.099] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d338 [0175.099] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.099] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.109] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.156] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x1d338, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0x1d338, lpOverlapped=0x0) returned 1 [0175.159] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x1d340, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0x1d340, lpOverlapped=0x0) returned 1 [0175.160] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.280] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.291] CloseHandle (hObject=0x1a4) returned 1 [0175.291] CloseHandle (hObject=0x19c) returned 1 [0175.291] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.292] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.292] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0175.292] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.292] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0175.292] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db")) returned 0 [0175.292] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003a.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003a.db")) returned 0x20 [0175.292] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.293] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.293] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.295] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bc48 [0175.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.295] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.302] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.348] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x1bc48, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0x1bc48, lpOverlapped=0x0) returned 1 [0175.350] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x1bc50, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0x1bc50, lpOverlapped=0x0) returned 1 [0175.353] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.370] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.374] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.382] CloseHandle (hObject=0x19c) returned 1 [0175.382] CloseHandle (hObject=0x1a4) returned 1 [0175.382] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.383] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.383] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0175.383] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.383] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0175.384] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db")) returned 0 [0175.384] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003b.db")) returned 0x20 [0175.384] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.384] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.384] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.386] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcee8 [0175.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.386] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.394] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.443] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0xcee8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0xcee8, lpOverlapped=0x0) returned 1 [0175.445] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0xcef0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0xcef0, lpOverlapped=0x0) returned 1 [0175.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.462] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.473] CloseHandle (hObject=0x1a4) returned 1 [0175.473] CloseHandle (hObject=0x19c) returned 1 [0175.473] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.474] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.474] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0175.474] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.475] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0175.475] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db")) returned 0 [0175.475] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000003c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000003c.db")) returned 0x20 [0175.475] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.475] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.475] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.476] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c68 [0175.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.477] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.484] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.531] ReadFile (in: hFile=0x19c, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x12c68, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0x12c68, lpOverlapped=0x0) returned 1 [0175.559] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x12c70, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0x12c70, lpOverlapped=0x0) returned 1 [0175.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.589] CloseHandle (hObject=0x19c) returned 1 [0175.589] CloseHandle (hObject=0x1a4) returned 1 [0175.589] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.590] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.590] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0175.590] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.590] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0175.590] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db")) returned 1 [0175.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db")) returned 0xffffffff [0175.591] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.592] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.592] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.592] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d00 [0175.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.593] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.599] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.643] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d470ac, nNumberOfBytesToRead=0x12d00, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesRead=0x19ecac*=0x12d00, lpOverlapped=0x0) returned 1 [0175.646] WriteFile (in: hFile=0x19c, lpBuffer=0x1d470ac*, nNumberOfBytesToWrite=0x12d10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d470ac*, lpNumberOfBytesWritten=0x19ecac*=0x12d10, lpOverlapped=0x0) returned 1 [0175.648] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.663] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.666] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.673] CloseHandle (hObject=0x1a4) returned 1 [0175.673] CloseHandle (hObject=0x19c) returned 1 [0175.673] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.674] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0175.674] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.674] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0175.674] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db")) returned 0 [0175.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001c.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001c.db")) returned 0x20 [0175.674] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0175.674] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0175.675] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0175.675] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0175.675] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.675] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.675] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.676] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.676] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.677] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.677] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0175.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.678] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.685] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.727] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47054, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0175.728] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47054*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47054*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0175.729] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.749] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.752] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.759] CloseHandle (hObject=0x19c) returned 1 [0175.759] CloseHandle (hObject=0x1a4) returned 1 [0175.760] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.760] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.760] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0175.761] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.761] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0175.761] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db")) returned 1 [0175.761] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1280.db")) returned 0xffffffff [0175.761] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.762] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.762] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.762] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0175.762] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.763] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.769] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.811] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0175.857] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0175.873] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.890] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.901] CloseHandle (hObject=0x1a4) returned 1 [0175.901] CloseHandle (hObject=0x19c) returned 1 [0175.901] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.902] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.902] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0175.903] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.903] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0175.903] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db")) returned 1 [0175.909] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_16.db")) returned 0xffffffff [0175.909] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.909] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.910] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.910] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0175.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.910] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0175.918] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0175.963] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0175.964] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0175.965] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0175.980] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0175.984] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.991] CloseHandle (hObject=0x19c) returned 1 [0175.991] CloseHandle (hObject=0x1a4) returned 1 [0175.991] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0175.992] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0175.992] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0175.992] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0175.992] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0175.992] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db")) returned 1 [0175.993] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_1920.db")) returned 0xffffffff [0175.993] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0175.993] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0175.993] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0175.994] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0175.994] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0175.994] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.001] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.043] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.044] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.045] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.060] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.064] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.071] CloseHandle (hObject=0x1a4) returned 1 [0176.071] CloseHandle (hObject=0x19c) returned 1 [0176.071] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.072] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.072] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0176.072] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.072] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0176.072] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db")) returned 1 [0176.073] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db")) returned 0xffffffff [0176.073] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.073] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.073] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.074] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0176.074] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.074] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.081] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.123] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.124] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.125] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.140] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.144] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.151] CloseHandle (hObject=0x19c) returned 1 [0176.151] CloseHandle (hObject=0x1a4) returned 1 [0176.151] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.152] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.152] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0176.152] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.152] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0176.152] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db")) returned 1 [0176.153] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_2560.db")) returned 0xffffffff [0176.153] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.153] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.153] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.154] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0176.154] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.154] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.161] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.293] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0176.335] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0176.350] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.365] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.371] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.377] CloseHandle (hObject=0x1a4) returned 1 [0176.378] CloseHandle (hObject=0x19c) returned 1 [0176.378] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.378] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.378] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0176.379] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.379] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0176.379] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db")) returned 1 [0176.386] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_32.db")) returned 0xffffffff [0176.386] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.386] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.386] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.386] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0176.387] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.387] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.393] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.436] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0176.460] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0176.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.489] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.500] CloseHandle (hObject=0x19c) returned 1 [0176.500] CloseHandle (hObject=0x1a4) returned 1 [0176.500] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.501] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0176.501] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.501] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0176.501] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")) returned 1 [0176.508] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")) returned 0xffffffff [0176.508] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.508] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.509] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.509] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0176.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.510] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.516] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.559] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.560] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.576] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.580] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.588] CloseHandle (hObject=0x1a4) returned 1 [0176.588] CloseHandle (hObject=0x19c) returned 1 [0176.588] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.589] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.589] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0176.589] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.589] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0176.589] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db")) returned 1 [0176.598] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_768.db")) returned 0xffffffff [0176.598] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.598] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.598] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.599] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0176.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.599] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.606] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.648] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.649] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.650] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.665] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.669] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.676] CloseHandle (hObject=0x19c) returned 1 [0176.676] CloseHandle (hObject=0x1a4) returned 1 [0176.676] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.676] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.677] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0176.677] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.677] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0176.677] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db")) returned 1 [0176.677] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_96.db")) returned 0xffffffff [0176.678] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.678] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.678] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.679] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0176.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.680] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.686] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.729] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4701c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.729] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4701c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.730] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.755] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.762] CloseHandle (hObject=0x1a4) returned 1 [0176.762] CloseHandle (hObject=0x19c) returned 1 [0176.762] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.763] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.763] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0176.763] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.763] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0176.763] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db")) returned 1 [0176.764] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_custom_stream.db")) returned 0xffffffff [0176.764] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.765] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.765] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.765] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0176.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.766] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.772] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.815] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.816] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.816] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.831] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.835] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.842] CloseHandle (hObject=0x19c) returned 1 [0176.842] CloseHandle (hObject=0x1a4) returned 1 [0176.842] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.843] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.843] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0176.843] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.843] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0176.843] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db")) returned 1 [0176.844] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_exif.db")) returned 0xffffffff [0176.844] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.844] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.844] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.845] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf8 [0176.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.845] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.852] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.894] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x1cf8, lpOverlapped=0x0) returned 1 [0176.895] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x1d00, lpOverlapped=0x0) returned 1 [0176.896] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.913] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0176.917] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.925] CloseHandle (hObject=0x1a4) returned 1 [0176.925] CloseHandle (hObject=0x19c) returned 1 [0176.925] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0176.926] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0176.926] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0176.926] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0176.926] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0176.926] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")) returned 1 [0176.927] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")) returned 0xffffffff [0176.927] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0176.928] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0176.928] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0176.928] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0176.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0176.929] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0176.936] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0176.981] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0176.981] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0176.982] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0176.998] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.002] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.009] CloseHandle (hObject=0x19c) returned 1 [0177.009] CloseHandle (hObject=0x1a4) returned 1 [0177.009] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.010] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.010] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0177.010] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.010] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0177.010] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db")) returned 1 [0177.011] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_sr.db")) returned 0xffffffff [0177.011] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.011] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.011] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.012] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.012] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.012] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.019] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.063] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.064] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.064] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.080] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.091] CloseHandle (hObject=0x1a4) returned 1 [0177.091] CloseHandle (hObject=0x19c) returned 1 [0177.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0177.092] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.092] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0177.092] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db")) returned 1 [0177.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide.db")) returned 0xffffffff [0177.093] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.093] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.093] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.094] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.094] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.101] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.144] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4701c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.145] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d4701c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.146] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.162] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.262] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.269] CloseHandle (hObject=0x19c) returned 1 [0177.269] CloseHandle (hObject=0x1a4) returned 1 [0177.269] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.270] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.270] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0177.270] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.270] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0177.270] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db")) returned 1 [0177.271] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_wide_alternate.db")) returned 0xffffffff [0177.271] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.271] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.271] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.272] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.272] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.280] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.325] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.326] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.327] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.343] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.346] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.353] CloseHandle (hObject=0x1a4) returned 1 [0177.353] CloseHandle (hObject=0x19c) returned 1 [0177.353] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.354] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.354] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0177.354] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.354] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0177.354] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db")) returned 1 [0177.355] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1280.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1280.db")) returned 0xffffffff [0177.355] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.355] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.355] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.356] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.356] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.363] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.406] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.406] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.423] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.426] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.433] CloseHandle (hObject=0x19c) returned 1 [0177.433] CloseHandle (hObject=0x1a4) returned 1 [0177.433] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.434] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.434] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0177.434] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.434] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0177.434] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db")) returned 1 [0177.435] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_16.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_16.db")) returned 0xffffffff [0177.435] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.435] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.435] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.436] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.436] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.443] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.486] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.487] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.487] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.503] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.506] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.513] CloseHandle (hObject=0x1a4) returned 1 [0177.513] CloseHandle (hObject=0x19c) returned 1 [0177.514] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.514] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.514] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0177.515] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.515] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0177.515] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db")) returned 1 [0177.515] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1920.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1920.db")) returned 0xffffffff [0177.515] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.516] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.516] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.516] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0177.516] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.517] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.526] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.567] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0177.592] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0177.607] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.623] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.626] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.633] CloseHandle (hObject=0x19c) returned 1 [0177.633] CloseHandle (hObject=0x1a4) returned 1 [0177.633] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.634] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.634] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0177.634] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.634] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0177.634] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 1 [0177.641] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0xffffffff [0177.641] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.642] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.642] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.649] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.691] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.691] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.692] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.707] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.711] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.718] CloseHandle (hObject=0x1a4) returned 1 [0177.718] CloseHandle (hObject=0x19c) returned 1 [0177.718] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.719] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.719] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0177.719] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.719] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0177.719] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db")) returned 1 [0177.720] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_2560.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_2560.db")) returned 0xffffffff [0177.720] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.720] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.720] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.721] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0177.721] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.721] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.728] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.777] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x100000, lpOverlapped=0x0) returned 1 [0177.835] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x100010, lpOverlapped=0x0) returned 1 [0177.849] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0177.865] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0177.869] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.875] CloseHandle (hObject=0x19c) returned 1 [0177.876] CloseHandle (hObject=0x1a4) returned 1 [0177.876] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0177.877] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0177.877] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0177.877] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.877] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0177.877] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 1 [0177.884] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0xffffffff [0177.884] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.884] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0177.884] CloseHandle (hObject=0xffffffff) returned 1 [0177.884] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 1 [0177.885] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0177.885] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0xffffffff [0177.885] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0177.885] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0177.885] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer")) returned 0 [0177.885] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db")) returned 0xffffffff [0177.885] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0177.886] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0177.886] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0177.940] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0177.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0177.940] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0177.947] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0177.989] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0177.990] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0177.990] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.008] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.012] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.018] CloseHandle (hObject=0x1a4) returned 1 [0178.018] CloseHandle (hObject=0x19c) returned 1 [0178.018] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.019] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.019] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0178.019] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.019] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0178.019] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db")) returned 1 [0178.020] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_768.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_768.db")) returned 0xffffffff [0178.020] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.020] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.020] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.021] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0178.021] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.021] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.029] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.072] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0178.073] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0178.073] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.088] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.092] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.099] CloseHandle (hObject=0x19c) returned 1 [0178.099] CloseHandle (hObject=0x1a4) returned 1 [0178.099] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.100] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.100] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0178.100] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.100] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0178.100] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 1 [0178.101] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0xffffffff [0178.101] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.101] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.101] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.102] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0178.102] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.102] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.110] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.160] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4701c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0178.161] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4701c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4701c*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0178.161] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.241] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.245] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.253] CloseHandle (hObject=0x1a4) returned 1 [0178.253] CloseHandle (hObject=0x19c) returned 1 [0178.253] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.254] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.254] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0178.254] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.254] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0178.254] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db")) returned 1 [0178.255] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_custom_stream.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_custom_stream.db")) returned 0xffffffff [0178.255] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.255] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.256] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.256] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0178.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.257] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.264] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.310] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0178.310] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0178.311] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.327] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.331] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.338] CloseHandle (hObject=0x19c) returned 1 [0178.338] CloseHandle (hObject=0x1a4) returned 1 [0178.338] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.339] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.339] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0178.339] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.339] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0178.339] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db")) returned 1 [0178.340] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_exif.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_exif.db")) returned 0xffffffff [0178.340] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.340] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.340] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.341] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1cf8 [0178.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.341] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.348] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.392] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x1cf8, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x1cf8, lpOverlapped=0x0) returned 1 [0178.392] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x1d00, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x1d00, lpOverlapped=0x0) returned 1 [0178.393] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.408] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.412] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.419] CloseHandle (hObject=0x1a4) returned 1 [0178.419] CloseHandle (hObject=0x19c) returned 1 [0178.419] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.420] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.420] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0178.420] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.420] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0178.420] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 1 [0178.421] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0xffffffff [0178.421] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.421] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.421] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.422] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0178.422] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.422] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.429] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.472] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0178.473] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0178.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.501] CloseHandle (hObject=0x19c) returned 1 [0178.501] CloseHandle (hObject=0x1a4) returned 1 [0178.501] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.502] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0178.502] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.502] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0178.502] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 1 [0178.503] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0xffffffff [0178.503] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.503] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.503] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.504] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0178.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.504] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.511] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.553] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d47014, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0178.554] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0178.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.570] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.574] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.580] CloseHandle (hObject=0x1a4) returned 1 [0178.580] CloseHandle (hObject=0x19c) returned 1 [0178.581] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.581] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.581] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0178.582] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.582] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0178.582] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db")) returned 1 [0178.582] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide.db")) returned 0xffffffff [0178.582] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.583] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0178.583] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.584] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.590] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.633] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47020, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47020*, lpNumberOfBytesRead=0x19ecac*=0x18, lpOverlapped=0x0) returned 1 [0178.633] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47020*, lpNumberOfBytesWritten=0x19ecac*=0x20, lpOverlapped=0x0) returned 1 [0178.634] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.649] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.653] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.660] CloseHandle (hObject=0x19c) returned 1 [0178.660] CloseHandle (hObject=0x1a4) returned 1 [0178.660] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.661] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0178.661] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.661] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0178.661] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db")) returned 1 [0178.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_wide_alternate.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_wide_alternate.db")) returned 0xffffffff [0178.662] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0178.662] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0178.662] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0178.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0178.662] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.662] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0178.662] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0178.662] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0178.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0178.663] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.663] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.663] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0178.664] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82 [0178.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.664] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.671] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.718] ReadFile (in: hFile=0x1a4, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x82, lpOverlapped=0x0) returned 1 [0178.718] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x90, lpOverlapped=0x0) returned 1 [0178.719] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.735] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.739] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.751] CloseHandle (hObject=0x1a4) returned 1 [0178.751] CloseHandle (hObject=0x19c) returned 1 [0178.751] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.752] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0178.752] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0178.752] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0178.752] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0178.752] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0178.753] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0178.753] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.753] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0178.753] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0178.753] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0178.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0178.754] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0178.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.755] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.762] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.807] WriteFile (in: hFile=0x190, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0178.807] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.823] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.827] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.835] CloseHandle (hObject=0x1a4) returned 1 [0178.835] CloseHandle (hObject=0x190) returned 1 [0178.835] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.836] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0178.836] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0178.836] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0178.836] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0178.836] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat")) returned 1 [0178.837] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\container.dat")) returned 0xffffffff [0178.837] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0178.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535080 [0178.837] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0178.837] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0178.837] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.837] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0178.871] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0178.871] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.872] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.878] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0178.922] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19e7dc*=0x10, lpOverlapped=0x0) returned 1 [0178.923] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0178.940] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0178.944] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.951] CloseHandle (hObject=0x1a4) returned 1 [0178.951] CloseHandle (hObject=0x1a0) returned 1 [0178.951] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0178.952] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0178.952] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535040 [0178.953] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0178.953] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0178.953] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat")) returned 1 [0178.953] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019020620190207\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019020620190207\\container.dat")) returned 0xffffffff [0178.953] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0178.953] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0178.953] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0178.953] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0178.953] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0178.953] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0178.953] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0178.954] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0178.954] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534c80 [0178.954] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0178.954] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0178.954] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0178.954] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0178.955] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0178.955] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0178.955] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0178.962] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.006] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19e7dc*=0x10, lpOverlapped=0x0) returned 1 [0179.007] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.022] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.026] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.033] CloseHandle (hObject=0x1a0) returned 1 [0179.033] CloseHandle (hObject=0x1a4) returned 1 [0179.033] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.034] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.034] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534d00 [0179.034] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0179.034] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0179.034] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat")) returned 1 [0179.035] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\container.dat")) returned 0xffffffff [0179.035] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0179.035] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0179.035] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0179.035] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0179.035] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0179.035] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0179.035] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0179.035] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0179.035] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.035] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.035] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0179.035] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0179.037] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.038] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.046] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.097] WriteFile (in: hFile=0x190, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0179.098] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.113] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.117] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.123] CloseHandle (hObject=0x19c) returned 1 [0179.124] CloseHandle (hObject=0x190) returned 1 [0179.124] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.125] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.125] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0179.125] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0179.125] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0179.125] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat")) returned 1 [0179.125] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\container.dat")) returned 0xffffffff [0179.125] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.125] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0179.126] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.126] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.126] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0179.126] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0179.127] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.127] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.134] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.284] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0179.285] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.301] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.306] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.312] CloseHandle (hObject=0x19c) returned 1 [0179.312] CloseHandle (hObject=0x1a4) returned 1 [0179.312] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.313] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.313] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0179.313] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0179.313] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0179.314] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat")) returned 1 [0179.314] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\container.dat")) returned 0xffffffff [0179.314] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0179.314] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0179.314] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0179.314] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0179.315] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0179.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f00 [0179.315] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.315] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.315] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0179.315] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0179.589] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.589] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.596] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.640] WriteFile (in: hFile=0x1a4, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0179.640] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.657] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.661] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.668] CloseHandle (hObject=0x190) returned 1 [0179.668] CloseHandle (hObject=0x1a4) returned 1 [0179.668] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.669] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.669] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0179.669] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0179.669] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0179.669] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat")) returned 1 [0179.669] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\container.dat")) returned 0xffffffff [0179.669] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.669] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0179.669] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.669] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.670] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0179.670] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0179.670] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.671] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.678] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.721] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0179.722] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.737] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.741] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.747] CloseHandle (hObject=0x190) returned 1 [0179.747] CloseHandle (hObject=0x19c) returned 1 [0179.747] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.748] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0179.748] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0179.748] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0179.748] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat")) returned 1 [0179.749] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\container.dat")) returned 0xffffffff [0179.749] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0179.749] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0179.749] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0179.749] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0179.749] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0179.749] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0179.749] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.749] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.749] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0179.749] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0179.750] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.750] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.763] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.805] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0179.806] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.821] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.825] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.833] CloseHandle (hObject=0x1a4) returned 1 [0179.833] CloseHandle (hObject=0x19c) returned 1 [0179.833] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.834] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.834] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0179.834] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0179.834] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0179.834] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat")) returned 1 [0179.834] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\container.dat")) returned 0xffffffff [0179.835] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0179.835] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0179.835] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0179.835] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535200 [0179.835] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.835] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.835] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0xffffffff [0179.835] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.835] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0179.835] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.835] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.835] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO\\VisioLogFiles\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535240 [0179.836] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0179.836] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0179.836] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0179.836] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0179.836] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0179.836] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.836] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0179.836] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.836] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0179.836] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0179.836] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.836] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0179.836] CloseHandle (hObject=0xffffffff) returned 1 [0179.836] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.837] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0179.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0179.837] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0179.837] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0179.837] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")) returned 0 [0179.837] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat")) returned 0x20 [0179.837] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0179.837] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.837] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.837] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0179.838] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0179.838] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.838] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.845] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.887] WriteFile (in: hFile=0x190, lpBuffer=0x1d47014*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47014*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0179.888] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.904] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.908] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.915] CloseHandle (hObject=0x1a4) returned 1 [0179.915] CloseHandle (hObject=0x190) returned 1 [0179.916] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0179.917] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0179.917] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0179.917] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0179.917] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0179.917] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat")) returned 1 [0179.917] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\container.dat")) returned 0xffffffff [0179.917] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0179.917] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0179.917] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0179.917] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0179.918] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.918] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.918] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\Content.IE5\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0xffffffff [0179.918] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0179.918] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535240 [0179.918] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0179.918] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0179.918] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a4 [0179.919] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0179.920] GetFileSize (in: hFile=0x1a4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0179.920] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0179.920] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0179.928] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0179.975] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e7dc, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19e7dc*=0x10, lpOverlapped=0x0) returned 1 [0179.976] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0179.992] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0179.997] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.004] CloseHandle (hObject=0x1a4) returned 1 [0180.004] CloseHandle (hObject=0x1a0) returned 1 [0180.004] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0180.005] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0180.005] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0180.005] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0 [0180.005] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0180.005] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat")) returned 1 [0180.005] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\IE\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\ie\\container.dat")) returned 0xffffffff [0180.005] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0180.005] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0180.005] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0180.006] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0180.006] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0180.007] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbfe0 [0180.007] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0180.007] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0180.014] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0180.059] ReadFile (in: hFile=0x190, lpBuffer=0x1d47058, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesRead=0x19ea44*=0xbfe0, lpOverlapped=0x0) returned 1 [0180.172] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ea44*=0xbff0, lpOverlapped=0x0) returned 1 [0180.173] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0180.189] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0180.338] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.347] CloseHandle (hObject=0x190) returned 1 [0180.347] CloseHandle (hObject=0x1a0) returned 1 [0180.348] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0180.349] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0180.349] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0180.349] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0180.349] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0180.349] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat")) returned 1 [0180.350] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\msimgsiz.dat")) returned 0xffffffff [0180.351] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0180.351] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0180.351] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0180.356] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e088 [0180.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0180.356] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0180.363] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0180.406] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47058, nNumberOfBytesToRead=0x1e088, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesRead=0x19ea44*=0x1e088, lpOverlapped=0x0) returned 1 [0180.504] WriteFile (in: hFile=0x190, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x1e090, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ea44*=0x1e090, lpOverlapped=0x0) returned 1 [0180.506] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0180.522] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0180.525] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.532] CloseHandle (hObject=0x1a0) returned 1 [0180.532] CloseHandle (hObject=0x190) returned 1 [0180.533] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0180.533] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0180.533] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0180.533] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0180.534] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0180.534] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat")) returned 1 [0180.535] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SmartScreenCache.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\smartscreencache.dat")) returned 0xffffffff [0180.535] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0180.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0180.535] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0180.536] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x500084 [0180.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0180.536] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0180.543] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0180.586] ReadFile (in: hFile=0x190, lpBuffer=0x1d47058, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesRead=0x19ea44*=0x500000, lpOverlapped=0x0) returned 1 [0181.106] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ea44*=0x500000, lpOverlapped=0x0) returned 1 [0181.289] ReadFile (in: hFile=0x190, lpBuffer=0x1d47058, nNumberOfBytesToRead=0x84, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesRead=0x19ea44*=0x84, lpOverlapped=0x0) returned 1 [0181.295] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47058*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47058*, lpNumberOfBytesWritten=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0181.298] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.314] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.318] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.325] CloseHandle (hObject=0x190) returned 1 [0181.325] CloseHandle (hObject=0x1a0) returned 1 [0181.325] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.326] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.326] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0181.326] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0181.326] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0181.326] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat")) returned 1 [0181.327] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\SuggestedSites.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\low\\suggestedsites.dat")) returned 0xffffffff [0181.327] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0181.327] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0181.327] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.327] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0181.327] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.327] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.327] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534ec0 [0181.328] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0181.329] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0181.329] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534f00 [0181.329] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0181.329] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0181.329] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\*.*", lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0x535080 [0181.329] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0181.329] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 1 [0181.329] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\AppData\\*.*", lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0x535000 [0181.329] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0181.329] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 1 [0181.329] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\*.*", lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0x534c80 [0181.330] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0181.330] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 1 [0181.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x19de5c | out: lpFindFileData=0x19de5c) returned 0x535240 [0181.330] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19de5c | out: lpFindFileData=0x19de5c) returned 1 [0181.330] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19de5c | out: lpFindFileData=0x19de5c) returned 1 [0181.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x19dbf4 | out: lpFindFileData=0x19dbf4) returned 0x535040 [0181.330] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dbf4 | out: lpFindFileData=0x19dbf4) returned 1 [0181.330] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dbf4 | out: lpFindFileData=0x19dbf4) returned 1 [0181.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.*", lpFindFileData=0x19d98c | out: lpFindFileData=0x19d98c) returned 0x534f40 [0181.330] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19d98c | out: lpFindFileData=0x19d98c) returned 1 [0181.330] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19d98c | out: lpFindFileData=0x19d98c) returned 0 [0181.330] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0181.330] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dbf4 | out: lpFindFileData=0x19dbf4) returned 1 [0181.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\C\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*.*", lpFindFileData=0x19d98c | out: lpFindFileData=0x19d98c) returned 0x535300 [0181.331] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19d98c | out: lpFindFileData=0x19d98c) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19d98c | out: lpFindFileData=0x19d98c) returned 0 [0181.331] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19dbf4 | out: lpFindFileData=0x19dbf4) returned 0 [0181.331] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19de5c | out: lpFindFileData=0x19de5c) returned 0 [0181.331] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e0c4 | out: lpFindFileData=0x19e0c4) returned 0 [0181.331] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e32c | out: lpFindFileData=0x19e32c) returned 0 [0181.331] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e594 | out: lpFindFileData=0x19e594) returned 0 [0181.331] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0181.331] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0181.331] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0181.331] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0181.331] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0181.331] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0181.331] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0181.332] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.332] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.332] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.333] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0181.333] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca [0181.333] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.333] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.341] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0181.390] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xca, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0xca, lpOverlapped=0x0) returned 1 [0181.390] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0xd0, lpOverlapped=0x0) returned 1 [0181.391] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.407] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.410] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.417] CloseHandle (hObject=0x19c) returned 1 [0181.417] CloseHandle (hObject=0x1a0) returned 1 [0181.417] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.418] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.418] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0181.418] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0181.418] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0181.418] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt")) returned 1 [0181.419] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\2XBM2EDN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\2xbm2edn.txt")) returned 0xffffffff [0181.419] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.420] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0181.420] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.421] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69 [0181.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.421] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.428] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0181.470] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x69, lpOverlapped=0x0) returned 1 [0181.471] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x70, lpOverlapped=0x0) returned 1 [0181.472] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.487] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.491] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.499] CloseHandle (hObject=0x1a0) returned 1 [0181.499] CloseHandle (hObject=0x19c) returned 1 [0181.499] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.499] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.500] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535400 [0181.500] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0181.500] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0181.500] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt")) returned 1 [0181.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\8489XH4E.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\8489xh4e.txt")) returned 0xffffffff [0181.501] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.501] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0181.502] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x169 [0181.502] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.503] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.509] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0181.551] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x169, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x169, lpOverlapped=0x0) returned 1 [0181.552] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x170, lpOverlapped=0x0) returned 1 [0181.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.569] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.573] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.580] CloseHandle (hObject=0x19c) returned 1 [0181.580] CloseHandle (hObject=0x1a0) returned 1 [0181.580] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.581] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.581] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0181.581] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0181.581] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0181.581] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt")) returned 1 [0181.582] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B4K109K7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b4k109k7.txt")) returned 0xffffffff [0181.582] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0181.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.584] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65 [0181.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.584] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.592] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0181.636] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x65, lpOverlapped=0x0) returned 1 [0181.637] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x70, lpOverlapped=0x0) returned 1 [0181.638] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.655] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.658] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.665] CloseHandle (hObject=0x1a0) returned 1 [0181.665] CloseHandle (hObject=0x19c) returned 1 [0181.665] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.666] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.666] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0181.666] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0181.666] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0181.666] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt")) returned 1 [0181.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\B67M68H4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\b67m68h4.txt")) returned 0xffffffff [0181.667] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.667] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.667] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0181.668] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0181.668] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.668] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.675] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0181.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0181.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.735] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.739] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.746] CloseHandle (hObject=0x19c) returned 1 [0181.746] CloseHandle (hObject=0x1a0) returned 1 [0181.746] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.747] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.747] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0181.747] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0181.747] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0181.747] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat")) returned 1 [0181.748] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\container.dat")) returned 0xffffffff [0181.748] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0181.748] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.748] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.748] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.748] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0181.873] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0181.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.873] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.880] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0181.923] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0181.923] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0181.939] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0181.942] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.949] CloseHandle (hObject=0x19c) returned 1 [0181.949] CloseHandle (hObject=0x190) returned 1 [0181.949] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0181.950] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0181.950] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0181.950] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0181.950] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0181.950] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat")) returned 1 [0181.951] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\container.dat")) returned 0xffffffff [0181.951] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.951] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534f00 [0181.951] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0181.951] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0181.951] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0181.951] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0181.951] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0181.951] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0181.951] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0181.952] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.952] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0181.953] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0181.953] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0181.954] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b [0181.954] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0181.954] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0181.961] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.004] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6b, lpOverlapped=0x0) returned 1 [0182.005] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0182.006] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.021] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.032] CloseHandle (hObject=0x190) returned 1 [0182.032] CloseHandle (hObject=0x19c) returned 1 [0182.032] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.033] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.033] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0182.033] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.033] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0182.033] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt")) returned 1 [0182.034] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0GHTMU6X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0ghtmu6x.txt")) returned 0xffffffff [0182.034] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.034] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.035] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.035] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1 [0182.035] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.035] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.043] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.085] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xa1, lpOverlapped=0x0) returned 1 [0182.086] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0182.086] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.101] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.105] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.112] CloseHandle (hObject=0x19c) returned 1 [0182.112] CloseHandle (hObject=0x190) returned 1 [0182.113] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.113] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.113] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0182.114] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.114] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0182.114] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt")) returned 1 [0182.114] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0MDKR34W.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0mdkr34w.txt")) returned 0xffffffff [0182.114] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.115] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.115] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.116] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0182.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.116] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.123] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.164] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xdf, lpOverlapped=0x0) returned 1 [0182.165] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xe0, lpOverlapped=0x0) returned 1 [0182.166] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.182] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.241] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.248] CloseHandle (hObject=0x190) returned 1 [0182.248] CloseHandle (hObject=0x19c) returned 1 [0182.248] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.249] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.249] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0182.249] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.249] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0182.249] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt")) returned 1 [0182.250] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\0Z1JIEVI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\0z1jievi.txt")) returned 0xffffffff [0182.250] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.251] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.251] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.362] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d [0182.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.363] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.370] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.412] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5d, lpOverlapped=0x0) returned 1 [0182.413] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0182.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.429] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.440] CloseHandle (hObject=0x19c) returned 1 [0182.440] CloseHandle (hObject=0x190) returned 1 [0182.440] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.441] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.441] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0182.441] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.441] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0182.441] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt")) returned 1 [0182.442] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16DOE15M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16doe15m.txt")) returned 0xffffffff [0182.442] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.442] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.443] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.444] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19e [0182.444] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.444] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.451] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.492] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x19e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x19e, lpOverlapped=0x0) returned 1 [0182.493] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x1a0, lpOverlapped=0x0) returned 1 [0182.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.509] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.513] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.520] CloseHandle (hObject=0x190) returned 1 [0182.520] CloseHandle (hObject=0x19c) returned 1 [0182.520] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.521] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.521] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0182.521] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.521] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0182.521] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt")) returned 1 [0182.522] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\16Y0X4V7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\16y0x4v7.txt")) returned 0xffffffff [0182.522] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.522] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.523] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.523] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0182.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.524] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.539] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.582] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6f, lpOverlapped=0x0) returned 1 [0182.582] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0182.671] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.686] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.690] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.697] CloseHandle (hObject=0x19c) returned 1 [0182.697] CloseHandle (hObject=0x190) returned 1 [0182.697] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.698] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.698] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0182.698] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.698] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0182.698] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt")) returned 1 [0182.699] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1L3KU69N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1l3ku69n.txt")) returned 0xffffffff [0182.699] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.699] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.700] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.700] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0182.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.700] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.707] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.749] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6f, lpOverlapped=0x0) returned 1 [0182.751] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0182.752] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.773] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.777] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.785] CloseHandle (hObject=0x190) returned 1 [0182.785] CloseHandle (hObject=0x19c) returned 1 [0182.785] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.786] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.786] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0182.786] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.786] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0182.786] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt")) returned 1 [0182.787] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LFQZEOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lfqzeoh.txt")) returned 0xffffffff [0182.787] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.787] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.787] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.788] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77 [0182.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.788] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.796] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.842] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x77, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x77, lpOverlapped=0x0) returned 1 [0182.842] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0182.843] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.859] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.863] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.870] CloseHandle (hObject=0x19c) returned 1 [0182.870] CloseHandle (hObject=0x190) returned 1 [0182.870] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.871] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.871] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0182.871] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.871] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0182.872] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt")) returned 1 [0182.872] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1LLUY7B7.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1lluy7b7.txt")) returned 0xffffffff [0182.872] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.873] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.873] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0182.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.874] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.881] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0182.924] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x112, lpOverlapped=0x0) returned 1 [0182.925] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x120, lpOverlapped=0x0) returned 1 [0182.925] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0182.941] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0182.944] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.951] CloseHandle (hObject=0x190) returned 1 [0182.951] CloseHandle (hObject=0x19c) returned 1 [0182.951] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0182.952] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0182.952] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0182.952] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0182.953] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0182.953] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt")) returned 1 [0182.954] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\1UYN2RFY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\1uyn2rfy.txt")) returned 0xffffffff [0182.954] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0182.954] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0182.955] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0182.955] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0182.955] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0182.956] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0182.962] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.005] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5c, lpOverlapped=0x0) returned 1 [0183.006] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0183.006] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.023] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.026] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.033] CloseHandle (hObject=0x19c) returned 1 [0183.033] CloseHandle (hObject=0x190) returned 1 [0183.033] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.034] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.034] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0183.034] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.035] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0183.035] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt")) returned 1 [0183.035] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\23JC2UTD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\23jc2utd.txt")) returned 0xffffffff [0183.035] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.036] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.036] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.037] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa9 [0183.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.037] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.044] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.086] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xa9, lpOverlapped=0x0) returned 1 [0183.087] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0183.091] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.106] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.109] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.116] CloseHandle (hObject=0x190) returned 1 [0183.116] CloseHandle (hObject=0x19c) returned 1 [0183.116] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.117] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.117] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0183.117] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.117] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0183.117] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt")) returned 1 [0183.118] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2EQ4E2OJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2eq4e2oj.txt")) returned 0xffffffff [0183.118] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.119] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.119] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.120] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f9 [0183.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.120] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.127] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.168] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2f9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x2f9, lpOverlapped=0x0) returned 1 [0183.246] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x300, lpOverlapped=0x0) returned 1 [0183.247] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.263] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.267] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.273] CloseHandle (hObject=0x19c) returned 1 [0183.273] CloseHandle (hObject=0x190) returned 1 [0183.274] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.274] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.274] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0183.274] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.274] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0183.275] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt")) returned 1 [0183.275] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\2HYILE1O.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\2hyile1o.txt")) returned 0xffffffff [0183.275] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.276] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.276] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.277] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51 [0183.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.277] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.284] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.327] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x51, lpOverlapped=0x0) returned 1 [0183.328] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0183.329] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.343] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.347] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.354] CloseHandle (hObject=0x190) returned 1 [0183.354] CloseHandle (hObject=0x19c) returned 1 [0183.354] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.355] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.356] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0183.356] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.356] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0183.356] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt")) returned 1 [0183.357] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3RW4K76X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3rw4k76x.txt")) returned 0xffffffff [0183.357] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.357] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.357] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.358] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x81 [0183.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.358] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.364] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.410] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x81, lpOverlapped=0x0) returned 1 [0183.411] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0183.412] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.427] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.430] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.437] CloseHandle (hObject=0x19c) returned 1 [0183.437] CloseHandle (hObject=0x190) returned 1 [0183.437] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.438] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.438] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0183.438] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.438] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0183.438] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt")) returned 1 [0183.439] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\3VVSZ2CO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\3vvsz2co.txt")) returned 0xffffffff [0183.439] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.439] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.441] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.441] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2 [0183.441] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.442] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.448] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.490] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xa2, lpOverlapped=0x0) returned 1 [0183.491] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0183.491] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.506] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.517] CloseHandle (hObject=0x190) returned 1 [0183.517] CloseHandle (hObject=0x19c) returned 1 [0183.518] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.518] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.519] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0183.519] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.519] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0183.519] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt")) returned 1 [0183.520] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4MN240WN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4mn240wn.txt")) returned 0xffffffff [0183.520] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.520] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.520] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.521] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x236 [0183.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.521] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.529] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.574] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x236, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x236, lpOverlapped=0x0) returned 1 [0183.575] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x240, lpOverlapped=0x0) returned 1 [0183.576] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.591] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.594] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.601] CloseHandle (hObject=0x19c) returned 1 [0183.601] CloseHandle (hObject=0x190) returned 1 [0183.601] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.602] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.602] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0183.602] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.602] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0183.602] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt")) returned 1 [0183.603] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4O6583I0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4o6583i0.txt")) returned 0xffffffff [0183.603] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.603] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.604] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.604] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f3 [0183.604] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.605] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.611] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.656] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1f3, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x1f3, lpOverlapped=0x0) returned 1 [0183.657] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x200, lpOverlapped=0x0) returned 1 [0183.658] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.673] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.685] CloseHandle (hObject=0x190) returned 1 [0183.685] CloseHandle (hObject=0x19c) returned 1 [0183.685] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.685] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.686] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0183.686] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.686] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0183.686] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt")) returned 1 [0183.686] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4YWCPPXN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4ywcppxn.txt")) returned 0xffffffff [0183.687] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.687] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.688] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.688] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a [0183.688] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.688] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.695] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.739] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5a, lpOverlapped=0x0) returned 1 [0183.739] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0183.740] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.755] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.759] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.772] CloseHandle (hObject=0x19c) returned 1 [0183.772] CloseHandle (hObject=0x190) returned 1 [0183.772] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.773] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.773] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0183.773] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.773] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0183.773] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt")) returned 1 [0183.774] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\4Z6UDYLY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\4z6udyly.txt")) returned 0xffffffff [0183.774] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.775] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.775] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.776] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc8 [0183.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.776] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.783] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.828] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xc8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xc8, lpOverlapped=0x0) returned 1 [0183.829] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xd0, lpOverlapped=0x0) returned 1 [0183.829] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0183.845] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0183.850] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.859] CloseHandle (hObject=0x190) returned 1 [0183.859] CloseHandle (hObject=0x19c) returned 1 [0183.860] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0183.861] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0183.861] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0183.861] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0183.861] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0183.861] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt")) returned 1 [0183.862] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AFMRGRY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5afmrgry.txt")) returned 0xffffffff [0183.862] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0183.862] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0183.863] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0183.867] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x329 [0183.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0183.867] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0183.876] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0183.919] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x329, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x329, lpOverlapped=0x0) returned 1 [0184.173] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x330, lpOverlapped=0x0) returned 1 [0184.174] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0184.220] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0184.224] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.231] CloseHandle (hObject=0x19c) returned 1 [0184.231] CloseHandle (hObject=0x190) returned 1 [0184.231] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0184.232] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0184.232] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0184.232] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0184.232] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0184.232] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt")) returned 1 [0184.233] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5ARQYMIV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5arqymiv.txt")) returned 0xffffffff [0184.233] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0184.233] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0184.234] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0184.234] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x154 [0184.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0184.235] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0184.242] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0184.285] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x154, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x154, lpOverlapped=0x0) returned 1 [0184.286] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x160, lpOverlapped=0x0) returned 1 [0184.287] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0184.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0184.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.314] CloseHandle (hObject=0x190) returned 1 [0184.314] CloseHandle (hObject=0x19c) returned 1 [0184.314] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0184.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0184.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0184.315] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0184.315] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0184.315] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt")) returned 1 [0184.316] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5AV8L20N.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5av8l20n.txt")) returned 0xffffffff [0184.316] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0184.316] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0184.317] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0184.318] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x67 [0184.318] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0184.318] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0184.325] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0184.368] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x67, lpOverlapped=0x0) returned 1 [0184.370] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0184.370] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0184.386] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0184.390] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.396] CloseHandle (hObject=0x19c) returned 1 [0184.396] CloseHandle (hObject=0x190) returned 1 [0184.397] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0184.397] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0184.397] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0184.397] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0184.398] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0184.398] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt")) returned 1 [0184.398] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5NWXN3UI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5nwxn3ui.txt")) returned 0xffffffff [0184.398] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0184.399] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0184.399] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0184.585] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dc [0184.585] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0184.585] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0184.592] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0184.634] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x2dc, lpOverlapped=0x0) returned 1 [0184.777] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x2e0, lpOverlapped=0x0) returned 1 [0184.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0184.794] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0184.799] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.805] CloseHandle (hObject=0x190) returned 1 [0184.806] CloseHandle (hObject=0x19c) returned 1 [0184.806] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0184.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0184.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0184.807] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0184.807] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0184.807] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt")) returned 1 [0184.808] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5STJ6NZL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5stj6nzl.txt")) returned 0xffffffff [0184.808] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0184.808] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0184.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0184.810] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaa [0184.810] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0184.810] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0184.817] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0184.862] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xaa, lpOverlapped=0x0) returned 1 [0184.862] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0184.863] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0184.879] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0184.883] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.890] CloseHandle (hObject=0x19c) returned 1 [0184.890] CloseHandle (hObject=0x190) returned 1 [0184.890] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0184.891] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0184.891] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0184.891] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0184.891] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0184.891] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt")) returned 1 [0184.892] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5TAY54V0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5tay54v0.txt")) returned 0xffffffff [0184.892] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0184.893] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0184.893] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0184.894] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbf [0184.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0184.894] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0184.901] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0184.944] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbf, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xbf, lpOverlapped=0x0) returned 1 [0184.945] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xc0, lpOverlapped=0x0) returned 1 [0184.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0184.961] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0184.965] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.972] CloseHandle (hObject=0x190) returned 1 [0184.972] CloseHandle (hObject=0x19c) returned 1 [0184.972] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0184.973] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0184.973] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0184.973] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0184.973] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0184.973] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt")) returned 1 [0184.974] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\5WQEGNKI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\5wqegnki.txt")) returned 0xffffffff [0184.974] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0184.975] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0184.976] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0184.976] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x61 [0184.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0184.977] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0184.984] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.026] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x61, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x61, lpOverlapped=0x0) returned 1 [0185.027] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0185.028] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.043] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.047] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.053] CloseHandle (hObject=0x19c) returned 1 [0185.053] CloseHandle (hObject=0x190) returned 1 [0185.054] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.054] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.054] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0185.055] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.055] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0185.055] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt")) returned 1 [0185.055] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\66I0OJL8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\66i0ojl8.txt")) returned 0xffffffff [0185.056] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.056] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.057] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.057] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5c [0185.058] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.058] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.066] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.109] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5c, lpOverlapped=0x0) returned 1 [0185.110] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0185.111] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.126] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.130] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.136] CloseHandle (hObject=0x190) returned 1 [0185.136] CloseHandle (hObject=0x19c) returned 1 [0185.136] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.138] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.138] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0185.138] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.138] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0185.138] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt")) returned 1 [0185.139] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\80J4IH0Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\80j4ih0y.txt")) returned 0xffffffff [0185.139] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.139] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.139] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.140] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x341 [0185.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.140] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.147] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.257] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x341, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x341, lpOverlapped=0x0) returned 1 [0185.424] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x350, lpOverlapped=0x0) returned 1 [0185.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.440] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.444] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.451] CloseHandle (hObject=0x19c) returned 1 [0185.451] CloseHandle (hObject=0x190) returned 1 [0185.451] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.452] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.452] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0185.452] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.453] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0185.453] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt")) returned 1 [0185.453] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\8FFCGS26.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\8ffcgs26.txt")) returned 0xffffffff [0185.454] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.454] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.454] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.455] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea [0185.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.455] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.462] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.505] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xea, lpOverlapped=0x0) returned 1 [0185.506] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xf0, lpOverlapped=0x0) returned 1 [0185.508] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.524] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.528] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.534] CloseHandle (hObject=0x190) returned 1 [0185.534] CloseHandle (hObject=0x19c) returned 1 [0185.534] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.535] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.535] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0185.535] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.535] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0185.535] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt")) returned 1 [0185.536] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9ABR37NL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9abr37nl.txt")) returned 0xffffffff [0185.536] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.537] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.537] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.538] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b [0185.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.538] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.545] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.586] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x16b, lpOverlapped=0x0) returned 1 [0185.587] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x170, lpOverlapped=0x0) returned 1 [0185.588] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.603] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.607] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.614] CloseHandle (hObject=0x19c) returned 1 [0185.614] CloseHandle (hObject=0x190) returned 1 [0185.614] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.615] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.615] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0185.615] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.615] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0185.615] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt")) returned 1 [0185.616] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9IJPMFHZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9ijpmfhz.txt")) returned 0xffffffff [0185.616] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.617] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.617] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.617] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f7 [0185.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.618] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.625] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.667] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x1f7, lpOverlapped=0x0) returned 1 [0185.668] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x200, lpOverlapped=0x0) returned 1 [0185.669] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.684] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.688] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.694] CloseHandle (hObject=0x190) returned 1 [0185.694] CloseHandle (hObject=0x19c) returned 1 [0185.694] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.695] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.695] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0185.695] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.695] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0185.695] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt")) returned 1 [0185.696] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9M7ZHW1Q.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9m7zhw1q.txt")) returned 0xffffffff [0185.696] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.697] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.697] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.697] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x29a [0185.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.698] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.705] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.748] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x29a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x29a, lpOverlapped=0x0) returned 1 [0185.749] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x2a0, lpOverlapped=0x0) returned 1 [0185.750] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.771] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.775] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.782] CloseHandle (hObject=0x19c) returned 1 [0185.782] CloseHandle (hObject=0x190) returned 1 [0185.782] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.783] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.783] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0185.783] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.783] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0185.783] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt")) returned 1 [0185.784] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9XACNSYG.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9xacnsyg.txt")) returned 0xffffffff [0185.784] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.784] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.785] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.786] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72 [0185.786] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.786] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.793] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.835] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x72, lpOverlapped=0x0) returned 1 [0185.836] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0185.836] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.852] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.855] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.863] CloseHandle (hObject=0x190) returned 1 [0185.863] CloseHandle (hObject=0x19c) returned 1 [0185.863] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.863] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.864] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0185.864] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.864] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0185.864] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt")) returned 1 [0185.864] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\9Z1Y5ICI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\9z1y5ici.txt")) returned 0xffffffff [0185.865] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.866] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.866] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.867] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80 [0185.867] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.867] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.874] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.915] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0185.915] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0185.917] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0185.932] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0185.936] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.942] CloseHandle (hObject=0x19c) returned 1 [0185.942] CloseHandle (hObject=0x190) returned 1 [0185.942] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0185.943] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0185.943] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0185.943] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0185.943] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0185.943] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt")) returned 1 [0185.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\A0RK8A2H.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\a0rk8a2h.txt")) returned 0xffffffff [0185.944] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0185.944] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0185.945] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0185.945] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0185.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0185.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0185.953] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0185.993] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x121, lpOverlapped=0x0) returned 1 [0185.994] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x130, lpOverlapped=0x0) returned 1 [0185.995] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.010] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.014] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.021] CloseHandle (hObject=0x190) returned 1 [0186.021] CloseHandle (hObject=0x19c) returned 1 [0186.021] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.021] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.022] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0186.022] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.022] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0186.022] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt")) returned 1 [0186.023] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\AA2IJ7JU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\aa2ij7ju.txt")) returned 0xffffffff [0186.023] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.023] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.023] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.024] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200 [0186.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.024] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.031] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.073] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x200, lpOverlapped=0x0) returned 1 [0186.075] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x210, lpOverlapped=0x0) returned 1 [0186.113] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.129] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.140] CloseHandle (hObject=0x19c) returned 1 [0186.140] CloseHandle (hObject=0x190) returned 1 [0186.140] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.141] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.141] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0186.141] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.141] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0186.141] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt")) returned 1 [0186.142] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\B427TFXJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\b427tfxj.txt")) returned 0xffffffff [0186.142] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.142] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.142] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.266] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xce [0186.266] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.267] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.273] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.316] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xce, lpOverlapped=0x0) returned 1 [0186.316] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xd0, lpOverlapped=0x0) returned 1 [0186.317] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.333] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.337] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.344] CloseHandle (hObject=0x190) returned 1 [0186.344] CloseHandle (hObject=0x19c) returned 1 [0186.344] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.345] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.345] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0186.345] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.345] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0186.345] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt")) returned 1 [0186.346] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\BK4HNAZ1.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\bk4hnaz1.txt")) returned 0xffffffff [0186.346] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.347] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.347] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.348] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f [0186.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.348] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.355] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.398] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x4f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x4f, lpOverlapped=0x0) returned 1 [0186.398] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x50, lpOverlapped=0x0) returned 1 [0186.399] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.415] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.419] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.425] CloseHandle (hObject=0x19c) returned 1 [0186.425] CloseHandle (hObject=0x190) returned 1 [0186.425] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.426] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0186.426] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.426] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0186.426] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt")) returned 1 [0186.427] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CC7DS78R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cc7ds78r.txt")) returned 0xffffffff [0186.427] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.428] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.428] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.428] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8c [0186.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.429] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.436] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.478] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x8c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x8c, lpOverlapped=0x0) returned 1 [0186.479] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0186.479] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.495] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.499] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.508] CloseHandle (hObject=0x190) returned 1 [0186.508] CloseHandle (hObject=0x19c) returned 1 [0186.508] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.510] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.510] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0186.510] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.510] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0186.510] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt")) returned 1 [0186.511] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CDGOWO27.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cdgowo27.txt")) returned 0xffffffff [0186.511] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.511] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.511] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.513] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0186.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.513] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.523] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.568] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0186.569] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.584] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.588] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.595] CloseHandle (hObject=0x19c) returned 1 [0186.595] CloseHandle (hObject=0x190) returned 1 [0186.595] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.596] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.596] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0186.596] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.596] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0186.596] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat")) returned 1 [0186.597] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\container.dat")) returned 0xffffffff [0186.597] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.597] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.597] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.598] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e [0186.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.598] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.605] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.648] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6e, lpOverlapped=0x0) returned 1 [0186.648] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0186.649] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.664] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.668] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.674] CloseHandle (hObject=0x190) returned 1 [0186.675] CloseHandle (hObject=0x19c) returned 1 [0186.675] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.675] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.675] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0186.676] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.676] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0186.676] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt")) returned 1 [0186.676] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\CYHYO8JD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\cyhyo8jd.txt")) returned 0xffffffff [0186.677] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.677] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.677] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.678] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x108 [0186.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.678] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.685] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.728] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x108, lpOverlapped=0x0) returned 1 [0186.729] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x110, lpOverlapped=0x0) returned 1 [0186.730] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0186.745] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0186.749] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.755] CloseHandle (hObject=0x19c) returned 1 [0186.756] CloseHandle (hObject=0x190) returned 1 [0186.756] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0186.756] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0186.757] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0186.757] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0186.757] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0186.757] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt")) returned 1 [0186.757] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\D9QO3KHK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\d9qo3khk.txt")) returned 0xffffffff [0186.758] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0186.758] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0186.759] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0186.759] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x561 [0186.759] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0186.759] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0186.771] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0186.815] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x561, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x561, lpOverlapped=0x0) returned 1 [0187.056] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x570, lpOverlapped=0x0) returned 1 [0187.057] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.072] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.076] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.083] CloseHandle (hObject=0x190) returned 1 [0187.083] CloseHandle (hObject=0x19c) returned 1 [0187.083] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.084] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.084] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0187.084] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.084] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0187.084] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt")) returned 1 [0187.085] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DN8YUCVA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dn8yucva.txt")) returned 0xffffffff [0187.085] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.085] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.086] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.087] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a [0187.087] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.087] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.094] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.136] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5a, lpOverlapped=0x0) returned 1 [0187.137] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0187.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.153] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.156] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.163] CloseHandle (hObject=0x19c) returned 1 [0187.163] CloseHandle (hObject=0x190) returned 1 [0187.163] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.164] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.164] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0187.164] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.164] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0187.164] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt")) returned 1 [0187.165] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DQI7WAG8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\dqi7wag8.txt")) returned 0xffffffff [0187.165] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.166] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.166] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.166] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d [0187.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.167] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.174] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.284] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5d, lpOverlapped=0x0) returned 1 [0187.285] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0187.286] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.301] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.305] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.312] CloseHandle (hObject=0x190) returned 1 [0187.312] CloseHandle (hObject=0x19c) returned 1 [0187.312] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.313] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.313] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0187.313] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.313] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0187.313] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt")) returned 1 [0187.314] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\DRDF2EZX.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\drdf2ezx.txt")) returned 0xffffffff [0187.314] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.314] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.315] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.315] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69 [0187.315] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.315] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.322] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.364] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x69, lpOverlapped=0x0) returned 1 [0187.364] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0187.365] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.381] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.384] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.391] CloseHandle (hObject=0x19c) returned 1 [0187.392] CloseHandle (hObject=0x190) returned 1 [0187.392] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.393] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.393] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0187.393] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.393] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0187.393] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt")) returned 1 [0187.394] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E2KPI4ZI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e2kpi4zi.txt")) returned 0xffffffff [0187.394] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.394] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.395] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.396] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99 [0187.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.396] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.403] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.445] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x99, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x99, lpOverlapped=0x0) returned 1 [0187.446] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xa0, lpOverlapped=0x0) returned 1 [0187.447] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.463] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.467] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.474] CloseHandle (hObject=0x190) returned 1 [0187.474] CloseHandle (hObject=0x19c) returned 1 [0187.474] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.475] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.475] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0187.475] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.475] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0187.475] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt")) returned 1 [0187.476] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\E978TFRK.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\e978tfrk.txt")) returned 0xffffffff [0187.476] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.477] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.477] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.514] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x68 [0187.514] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.515] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.521] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.563] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x68, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x68, lpOverlapped=0x0) returned 1 [0187.563] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0187.564] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.579] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.583] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.590] CloseHandle (hObject=0x19c) returned 1 [0187.590] CloseHandle (hObject=0x190) returned 1 [0187.590] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.591] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0187.591] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.591] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0187.591] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt")) returned 1 [0187.592] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\F68MFAMN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\f68mfamn.txt")) returned 0xffffffff [0187.592] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.592] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.592] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.593] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f [0187.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.593] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.600] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.642] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x12f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x12f, lpOverlapped=0x0) returned 1 [0187.643] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x130, lpOverlapped=0x0) returned 1 [0187.643] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.661] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.665] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.672] CloseHandle (hObject=0x190) returned 1 [0187.672] CloseHandle (hObject=0x19c) returned 1 [0187.672] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.673] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.673] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0187.673] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.673] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0187.673] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt")) returned 1 [0187.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FCGXHIFT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fcgxhift.txt")) returned 0xffffffff [0187.674] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.674] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.674] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.675] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59 [0187.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.675] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.682] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.724] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x59, lpOverlapped=0x0) returned 1 [0187.724] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0187.725] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.741] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.744] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.751] CloseHandle (hObject=0x19c) returned 1 [0187.751] CloseHandle (hObject=0x190) returned 1 [0187.752] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.752] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.752] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0187.753] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.753] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0187.753] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt")) returned 1 [0187.754] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FGTTES1V.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fgttes1v.txt")) returned 0xffffffff [0187.754] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.755] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21c [0187.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.755] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.768] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.810] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x21c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x21c, lpOverlapped=0x0) returned 1 [0187.811] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x220, lpOverlapped=0x0) returned 1 [0187.812] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0187.827] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0187.831] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.837] CloseHandle (hObject=0x190) returned 1 [0187.837] CloseHandle (hObject=0x19c) returned 1 [0187.838] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0187.838] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0187.838] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0187.839] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0187.839] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0187.839] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt")) returned 1 [0187.840] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FLTMVY1F.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\fltmvy1f.txt")) returned 0xffffffff [0187.840] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0187.840] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0187.841] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0187.842] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5 [0187.842] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0187.842] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0187.849] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0187.917] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb5, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xb5, lpOverlapped=0x0) returned 1 [0187.917] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xc0, lpOverlapped=0x0) returned 1 [0188.289] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.305] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.308] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.315] CloseHandle (hObject=0x19c) returned 1 [0188.315] CloseHandle (hObject=0x190) returned 1 [0188.315] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.316] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.316] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0188.316] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.316] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0188.316] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt")) returned 1 [0188.317] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\FOLSAQT6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\folsaqt6.txt")) returned 0xffffffff [0188.317] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.318] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.318] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.319] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0188.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.319] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.326] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.368] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x13e, lpOverlapped=0x0) returned 1 [0188.369] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x140, lpOverlapped=0x0) returned 1 [0188.370] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.385] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.388] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.395] CloseHandle (hObject=0x190) returned 1 [0188.395] CloseHandle (hObject=0x19c) returned 1 [0188.395] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.396] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.396] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0188.396] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.396] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0188.396] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt")) returned 1 [0188.397] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\GXB342YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\gxb342ys.txt")) returned 0xffffffff [0188.397] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.397] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.398] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.399] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x254 [0188.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.399] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.407] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.448] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x254, lpOverlapped=0x0) returned 1 [0188.448] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x260, lpOverlapped=0x0) returned 1 [0188.449] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.464] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.468] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.476] CloseHandle (hObject=0x19c) returned 1 [0188.476] CloseHandle (hObject=0x190) returned 1 [0188.477] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.478] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0188.478] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.478] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0188.478] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt")) returned 1 [0188.479] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\H5LCJX1B.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\h5lcjx1b.txt")) returned 0xffffffff [0188.479] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.479] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.480] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.480] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24a [0188.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.481] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.488] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.530] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x24a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x24a, lpOverlapped=0x0) returned 1 [0188.531] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x250, lpOverlapped=0x0) returned 1 [0188.532] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.548] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.552] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.558] CloseHandle (hObject=0x190) returned 1 [0188.558] CloseHandle (hObject=0x19c) returned 1 [0188.558] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.559] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.559] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0188.560] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.560] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0188.560] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt")) returned 1 [0188.560] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HBPP9XXY.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hbpp9xxy.txt")) returned 0xffffffff [0188.560] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.561] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.562] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f [0188.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.562] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.569] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.610] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x11f, lpOverlapped=0x0) returned 1 [0188.612] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x120, lpOverlapped=0x0) returned 1 [0188.613] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.628] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.632] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.639] CloseHandle (hObject=0x19c) returned 1 [0188.639] CloseHandle (hObject=0x190) returned 1 [0188.639] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.640] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.640] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0188.640] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.640] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0188.640] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt")) returned 1 [0188.641] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HF8F6LU0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\hf8f6lu0.txt")) returned 0xffffffff [0188.641] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.641] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.642] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70 [0188.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.642] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.649] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.695] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x70, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0188.696] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0188.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.717] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.721] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.728] CloseHandle (hObject=0x190) returned 1 [0188.728] CloseHandle (hObject=0x19c) returned 1 [0188.728] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.729] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.729] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0188.729] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.729] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0188.729] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt")) returned 1 [0188.730] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\HTVL5WIW.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\htvl5wiw.txt")) returned 0xffffffff [0188.730] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.731] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.731] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.732] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0188.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.732] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.739] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.787] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x110, lpOverlapped=0x0) returned 1 [0188.788] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x120, lpOverlapped=0x0) returned 1 [0188.789] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.806] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.810] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.817] CloseHandle (hObject=0x19c) returned 1 [0188.817] CloseHandle (hObject=0x190) returned 1 [0188.817] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.818] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.818] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0188.818] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.818] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0188.818] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt")) returned 1 [0188.819] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ILF13HLB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ilf13hlb.txt")) returned 0xffffffff [0188.819] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.820] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.820] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.821] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14a [0188.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.821] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.828] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.872] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x14a, lpOverlapped=0x0) returned 1 [0188.873] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x150, lpOverlapped=0x0) returned 1 [0188.873] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.889] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.892] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.899] CloseHandle (hObject=0x190) returned 1 [0188.899] CloseHandle (hObject=0x19c) returned 1 [0188.899] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.900] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.900] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0188.900] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.900] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0188.900] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt")) returned 1 [0188.901] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ISTFXHHR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\istfxhhr.txt")) returned 0xffffffff [0188.901] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.902] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0188.902] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.903] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbb [0188.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0188.903] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0188.910] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0188.953] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xbb, lpOverlapped=0x0) returned 1 [0188.954] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xc0, lpOverlapped=0x0) returned 1 [0188.954] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0188.970] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0188.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.980] CloseHandle (hObject=0x19c) returned 1 [0188.980] CloseHandle (hObject=0x190) returned 1 [0188.980] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0188.981] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0188.981] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0188.982] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0188.982] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0188.982] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt")) returned 1 [0188.983] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\ITD4OUAR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\itd4ouar.txt")) returned 0xffffffff [0188.983] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0188.983] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0188.983] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.265] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c8 [0189.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.266] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.273] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.316] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x2c8, lpOverlapped=0x0) returned 1 [0189.316] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x2d0, lpOverlapped=0x0) returned 1 [0189.317] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.333] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.336] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.343] CloseHandle (hObject=0x190) returned 1 [0189.343] CloseHandle (hObject=0x19c) returned 1 [0189.343] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.344] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.344] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0189.344] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.344] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0189.344] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt")) returned 1 [0189.345] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\J4JSQG9R.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\j4jsqg9r.txt")) returned 0xffffffff [0189.345] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.346] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.346] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.347] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f4 [0189.347] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.347] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.354] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.396] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x3f4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x3f4, lpOverlapped=0x0) returned 1 [0189.397] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0189.398] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.413] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.416] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.423] CloseHandle (hObject=0x19c) returned 1 [0189.423] CloseHandle (hObject=0x190) returned 1 [0189.423] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.424] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.424] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0189.425] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.425] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0189.425] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt")) returned 1 [0189.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JQOCYKOH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jqocykoh.txt")) returned 0xffffffff [0189.426] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.427] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb3 [0189.427] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.427] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.434] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.476] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xb3, lpOverlapped=0x0) returned 1 [0189.477] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xc0, lpOverlapped=0x0) returned 1 [0189.478] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.496] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.500] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.509] CloseHandle (hObject=0x190) returned 1 [0189.509] CloseHandle (hObject=0x19c) returned 1 [0189.509] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.510] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.510] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0189.510] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.510] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0189.510] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt")) returned 1 [0189.511] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\JWFWLAYR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\jwfwlayr.txt")) returned 0xffffffff [0189.511] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.512] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.512] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.513] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0189.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.514] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.522] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.567] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xeb, lpOverlapped=0x0) returned 1 [0189.568] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xf0, lpOverlapped=0x0) returned 1 [0189.569] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.588] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.598] CloseHandle (hObject=0x19c) returned 1 [0189.598] CloseHandle (hObject=0x190) returned 1 [0189.598] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.599] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.599] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0189.599] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.599] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0189.599] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt")) returned 1 [0189.600] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\K8249Y1G.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\k8249y1g.txt")) returned 0xffffffff [0189.600] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.601] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.601] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.601] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x203 [0189.601] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.602] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.608] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.649] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x203, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x203, lpOverlapped=0x0) returned 1 [0189.650] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x210, lpOverlapped=0x0) returned 1 [0189.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.666] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.670] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.679] CloseHandle (hObject=0x190) returned 1 [0189.679] CloseHandle (hObject=0x19c) returned 1 [0189.679] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.680] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.680] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0189.680] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.680] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0189.680] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt")) returned 1 [0189.681] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\KNJ4AJDH.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\knj4ajdh.txt")) returned 0xffffffff [0189.681] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.681] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.682] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.682] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0189.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.683] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.692] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.738] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6f, lpOverlapped=0x0) returned 1 [0189.739] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0189.740] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.756] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.759] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.766] CloseHandle (hObject=0x19c) returned 1 [0189.766] CloseHandle (hObject=0x190) returned 1 [0189.766] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.767] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.767] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0189.767] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.767] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0189.767] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt")) returned 1 [0189.773] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\L78EW25D.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\l78ew25d.txt")) returned 0xffffffff [0189.773] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.774] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.775] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.776] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14b [0189.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.776] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.783] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.824] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x14b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x14b, lpOverlapped=0x0) returned 1 [0189.825] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x150, lpOverlapped=0x0) returned 1 [0189.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.841] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.844] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.851] CloseHandle (hObject=0x190) returned 1 [0189.851] CloseHandle (hObject=0x19c) returned 1 [0189.851] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.852] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.852] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0189.852] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.852] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0189.852] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt")) returned 1 [0189.853] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LC10XEWL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lc10xewl.txt")) returned 0xffffffff [0189.853] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.854] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.854] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105 [0189.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.855] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.861] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.903] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x105, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x105, lpOverlapped=0x0) returned 1 [0189.904] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x110, lpOverlapped=0x0) returned 1 [0189.905] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0189.920] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0189.923] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.930] CloseHandle (hObject=0x19c) returned 1 [0189.930] CloseHandle (hObject=0x190) returned 1 [0189.931] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0189.931] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0189.932] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0189.932] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0189.932] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0189.932] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt")) returned 1 [0189.933] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LVARU12Y.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\lvaru12y.txt")) returned 0xffffffff [0189.933] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0189.933] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0189.933] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0189.934] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x193 [0189.934] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0189.934] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0189.941] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0189.984] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x193, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x193, lpOverlapped=0x0) returned 1 [0189.984] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x1a0, lpOverlapped=0x0) returned 1 [0190.002] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.017] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.021] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.028] CloseHandle (hObject=0x190) returned 1 [0190.028] CloseHandle (hObject=0x19c) returned 1 [0190.028] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.029] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.029] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0190.029] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.029] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0190.030] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt")) returned 1 [0190.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY1NFEKN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly1nfekn.txt")) returned 0xffffffff [0190.030] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.031] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.032] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x137 [0190.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.032] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.039] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.082] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x137, lpOverlapped=0x0) returned 1 [0190.115] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x140, lpOverlapped=0x0) returned 1 [0190.116] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.132] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.135] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.142] CloseHandle (hObject=0x19c) returned 1 [0190.142] CloseHandle (hObject=0x190) returned 1 [0190.142] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.144] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.144] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0190.145] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.145] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0190.145] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt")) returned 1 [0190.146] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\LY3FDU65.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ly3fdu65.txt")) returned 0xffffffff [0190.146] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.146] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.147] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.147] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x121 [0190.148] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.148] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.155] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.199] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x121, lpOverlapped=0x0) returned 1 [0190.200] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x130, lpOverlapped=0x0) returned 1 [0190.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.279] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.282] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.289] CloseHandle (hObject=0x190) returned 1 [0190.289] CloseHandle (hObject=0x19c) returned 1 [0190.290] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.290] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.290] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0190.290] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.291] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0190.291] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt")) returned 1 [0190.291] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\M19117WZ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\m19117wz.txt")) returned 0xffffffff [0190.291] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.292] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.292] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.293] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58 [0190.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.293] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.300] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.342] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x58, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x58, lpOverlapped=0x0) returned 1 [0190.343] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0190.344] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.360] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.364] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.371] CloseHandle (hObject=0x19c) returned 1 [0190.371] CloseHandle (hObject=0x190) returned 1 [0190.371] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.372] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.372] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0190.372] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.372] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0190.372] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt")) returned 1 [0190.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MA5WDFBR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ma5wdfbr.txt")) returned 0xffffffff [0190.373] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.374] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.374] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.375] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca [0190.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.375] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.383] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.425] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xca, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xca, lpOverlapped=0x0) returned 1 [0190.426] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xd0, lpOverlapped=0x0) returned 1 [0190.426] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.441] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.453] CloseHandle (hObject=0x190) returned 1 [0190.453] CloseHandle (hObject=0x19c) returned 1 [0190.454] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.455] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0190.455] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.455] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0190.455] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt")) returned 1 [0190.456] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MBJX4MYA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mbjx4mya.txt")) returned 0xffffffff [0190.456] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.457] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.457] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.458] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0190.458] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.458] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.466] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.509] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x66, lpOverlapped=0x0) returned 1 [0190.510] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0190.511] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.530] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.537] CloseHandle (hObject=0x19c) returned 1 [0190.537] CloseHandle (hObject=0x190) returned 1 [0190.537] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.538] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0190.538] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.538] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0190.538] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt")) returned 1 [0190.539] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MCAKE788.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mcake788.txt")) returned 0xffffffff [0190.539] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.539] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.539] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.540] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa3 [0190.540] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.540] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.547] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.589] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa3, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xa3, lpOverlapped=0x0) returned 1 [0190.590] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0190.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.609] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.613] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.621] CloseHandle (hObject=0x190) returned 1 [0190.621] CloseHandle (hObject=0x19c) returned 1 [0190.622] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.622] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.622] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0190.623] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.623] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0190.623] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt")) returned 1 [0190.623] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MIL4MU1S.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mil4mu1s.txt")) returned 0xffffffff [0190.623] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.624] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.624] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.625] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b2 [0190.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.625] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.632] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.676] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1b2, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x1b2, lpOverlapped=0x0) returned 1 [0190.676] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x1c0, lpOverlapped=0x0) returned 1 [0190.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.693] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.697] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.704] CloseHandle (hObject=0x19c) returned 1 [0190.704] CloseHandle (hObject=0x190) returned 1 [0190.704] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.705] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.705] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0190.705] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.705] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0190.705] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt")) returned 1 [0190.706] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MM8KB9U2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mm8kb9u2.txt")) returned 0xffffffff [0190.706] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.708] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0190.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.708] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.716] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.761] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x104, lpOverlapped=0x0) returned 1 [0190.762] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x110, lpOverlapped=0x0) returned 1 [0190.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.789] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.793] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.800] CloseHandle (hObject=0x190) returned 1 [0190.800] CloseHandle (hObject=0x19c) returned 1 [0190.800] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.801] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.801] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0190.801] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.801] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0190.801] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt")) returned 1 [0190.802] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MMPF10F4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\mmpf10f4.txt")) returned 0xffffffff [0190.802] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.803] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.803] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.803] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x76 [0190.804] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.804] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.812] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.855] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x76, lpOverlapped=0x0) returned 1 [0190.855] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0190.856] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.872] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.876] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.882] CloseHandle (hObject=0x19c) returned 1 [0190.883] CloseHandle (hObject=0x190) returned 1 [0190.883] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.883] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.884] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0190.884] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.884] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0190.884] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt")) returned 1 [0190.885] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\MOE7DCQU.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\moe7dcqu.txt")) returned 0xffffffff [0190.885] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.885] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.885] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.886] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72 [0190.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.886] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.894] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0190.939] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x72, lpOverlapped=0x0) returned 1 [0190.940] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0190.941] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0190.956] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0190.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.966] CloseHandle (hObject=0x190) returned 1 [0190.966] CloseHandle (hObject=0x19c) returned 1 [0190.966] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0190.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0190.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0190.967] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0190.967] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0190.968] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt")) returned 1 [0190.968] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NEHE4KDB.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nehe4kdb.txt")) returned 0xffffffff [0190.968] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0190.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0190.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0190.970] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x89 [0190.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0190.970] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0190.977] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.018] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x89, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x89, lpOverlapped=0x0) returned 1 [0191.019] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0191.020] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.034] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.038] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.044] CloseHandle (hObject=0x19c) returned 1 [0191.044] CloseHandle (hObject=0x190) returned 1 [0191.045] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.045] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.045] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0191.045] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.045] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0191.046] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt")) returned 1 [0191.046] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NOCAHPZ6.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nocahpz6.txt")) returned 0xffffffff [0191.046] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.047] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.047] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.047] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x640 [0191.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.048] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.054] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.096] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x640, lpOverlapped=0x0) returned 1 [0191.430] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x650, lpOverlapped=0x0) returned 1 [0191.431] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.446] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.450] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.456] CloseHandle (hObject=0x190) returned 1 [0191.457] CloseHandle (hObject=0x19c) returned 1 [0191.457] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.457] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.458] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0191.458] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.458] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0191.458] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt")) returned 1 [0191.458] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\NYCCG1AV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\nyccg1av.txt")) returned 0xffffffff [0191.459] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.460] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e [0191.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.460] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.467] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.513] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6e, lpOverlapped=0x0) returned 1 [0191.514] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0191.515] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.530] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.540] CloseHandle (hObject=0x19c) returned 1 [0191.540] CloseHandle (hObject=0x190) returned 1 [0191.540] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.541] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.542] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0191.542] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.542] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0191.542] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt")) returned 1 [0191.543] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\O8FFFI2K.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\o8fffi2k.txt")) returned 0xffffffff [0191.543] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.543] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.543] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.544] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x57 [0191.544] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.544] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.551] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.592] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x57, lpOverlapped=0x0) returned 1 [0191.593] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0191.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.608] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.618] CloseHandle (hObject=0x190) returned 1 [0191.618] CloseHandle (hObject=0x19c) returned 1 [0191.618] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.619] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0191.620] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.620] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0191.620] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt")) returned 1 [0191.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\P778SMC9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\p778smc9.txt")) returned 0xffffffff [0191.621] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.621] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.622] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.622] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xab [0191.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.623] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.629] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.671] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xab, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xab, lpOverlapped=0x0) returned 1 [0191.671] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0191.672] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.687] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.691] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.697] CloseHandle (hObject=0x19c) returned 1 [0191.697] CloseHandle (hObject=0x190) returned 1 [0191.697] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.698] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.698] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0191.698] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.698] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0191.698] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt")) returned 1 [0191.699] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PF9HBAFQ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pf9hbafq.txt")) returned 0xffffffff [0191.699] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.700] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.700] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.700] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf [0191.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.701] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.707] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.749] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xdf, lpOverlapped=0x0) returned 1 [0191.749] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xe0, lpOverlapped=0x0) returned 1 [0191.750] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.765] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.769] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.780] CloseHandle (hObject=0x190) returned 1 [0191.781] CloseHandle (hObject=0x19c) returned 1 [0191.781] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.781] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.782] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0191.782] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.782] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0191.782] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt")) returned 1 [0191.783] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\PK3I34UV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\pk3i34uv.txt")) returned 0xffffffff [0191.783] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.783] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.783] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.784] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56 [0191.784] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.784] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.791] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.832] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x56, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x56, lpOverlapped=0x0) returned 1 [0191.833] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0191.833] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.848] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.852] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.859] CloseHandle (hObject=0x19c) returned 1 [0191.859] CloseHandle (hObject=0x190) returned 1 [0191.859] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.860] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.860] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0191.860] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.860] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0191.860] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt")) returned 1 [0191.861] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\QUMCK8L4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\qumck8l4.txt")) returned 0xffffffff [0191.861] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.861] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.862] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.862] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f9 [0191.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.862] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.870] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.911] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x1f9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x1f9, lpOverlapped=0x0) returned 1 [0191.912] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x200, lpOverlapped=0x0) returned 1 [0191.912] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0191.927] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0191.931] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.937] CloseHandle (hObject=0x190) returned 1 [0191.937] CloseHandle (hObject=0x19c) returned 1 [0191.938] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0191.939] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0191.939] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0191.939] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0191.939] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0191.939] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt")) returned 1 [0191.940] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RAYRHE6Z.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rayrhe6z.txt")) returned 0xffffffff [0191.940] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0191.940] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0191.940] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0191.942] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x187 [0191.942] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0191.942] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0191.949] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0191.992] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x187, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x187, lpOverlapped=0x0) returned 1 [0191.993] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x190, lpOverlapped=0x0) returned 1 [0191.994] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.010] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.013] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.020] CloseHandle (hObject=0x19c) returned 1 [0192.020] CloseHandle (hObject=0x190) returned 1 [0192.020] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.021] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.021] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0192.021] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.021] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0192.021] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt")) returned 1 [0192.022] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RQK5QF4L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rqk5qf4l.txt")) returned 0xffffffff [0192.022] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.022] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.022] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.023] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0192.023] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.023] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.030] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.144] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xed, lpOverlapped=0x0) returned 1 [0192.145] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xf0, lpOverlapped=0x0) returned 1 [0192.146] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.161] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.164] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.171] CloseHandle (hObject=0x190) returned 1 [0192.171] CloseHandle (hObject=0x19c) returned 1 [0192.171] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.172] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.172] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0192.172] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.172] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0192.173] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt")) returned 1 [0192.173] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RTEPN67M.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\rtepn67m.txt")) returned 0xffffffff [0192.173] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.174] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.174] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.175] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71 [0192.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.175] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.182] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.271] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x71, lpOverlapped=0x0) returned 1 [0192.272] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0192.272] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.288] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.299] CloseHandle (hObject=0x19c) returned 1 [0192.299] CloseHandle (hObject=0x190) returned 1 [0192.299] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.300] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.300] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0192.300] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.300] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0192.300] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt")) returned 1 [0192.301] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\RYK7X1K4.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ryk7x1k4.txt")) returned 0xffffffff [0192.301] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.301] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.301] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.302] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b [0192.302] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.302] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.309] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.351] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x7b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x7b, lpOverlapped=0x0) returned 1 [0192.352] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x80, lpOverlapped=0x0) returned 1 [0192.353] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.368] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.378] CloseHandle (hObject=0x190) returned 1 [0192.378] CloseHandle (hObject=0x19c) returned 1 [0192.379] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.379] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.379] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0192.380] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.380] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0192.380] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt")) returned 1 [0192.380] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\S0EK69P5.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\s0ek69p5.txt")) returned 0xffffffff [0192.380] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.381] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.381] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.382] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x58 [0192.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.382] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.389] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.430] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x58, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x58, lpOverlapped=0x0) returned 1 [0192.431] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0192.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.446] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.450] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.457] CloseHandle (hObject=0x19c) returned 1 [0192.457] CloseHandle (hObject=0x190) returned 1 [0192.457] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.458] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.458] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0192.458] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.458] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0192.458] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt")) returned 1 [0192.459] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\SEVCUJM3.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\sevcujm3.txt")) returned 0xffffffff [0192.459] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.459] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.460] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b [0192.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.460] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.467] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.509] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6b, lpOverlapped=0x0) returned 1 [0192.510] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0192.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.529] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.536] CloseHandle (hObject=0x190) returned 1 [0192.536] CloseHandle (hObject=0x19c) returned 1 [0192.536] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.537] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.537] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0192.537] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.537] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0192.537] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt")) returned 1 [0192.538] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\STGOZ493.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\stgoz493.txt")) returned 0xffffffff [0192.538] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.539] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.539] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.540] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0192.540] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.540] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.547] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.596] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x50, lpOverlapped=0x0) returned 1 [0192.597] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0192.598] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.613] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.617] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.624] CloseHandle (hObject=0x19c) returned 1 [0192.624] CloseHandle (hObject=0x190) returned 1 [0192.624] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.625] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0192.625] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.625] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0192.625] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt")) returned 1 [0192.626] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\T1LCPPSA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\t1lcppsa.txt")) returned 0xffffffff [0192.626] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.626] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.626] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.627] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c [0192.627] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.627] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.634] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.676] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6c, lpOverlapped=0x0) returned 1 [0192.677] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0192.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.693] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.697] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.704] CloseHandle (hObject=0x190) returned 1 [0192.704] CloseHandle (hObject=0x19c) returned 1 [0192.704] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.705] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.705] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0192.705] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.705] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0192.705] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt")) returned 1 [0192.706] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TCXQPY9L.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tcxqpy9l.txt")) returned 0xffffffff [0192.706] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.707] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0192.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.708] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.715] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.756] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x91, lpOverlapped=0x0) returned 1 [0192.756] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xa0, lpOverlapped=0x0) returned 1 [0192.757] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.772] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.782] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.788] CloseHandle (hObject=0x19c) returned 1 [0192.788] CloseHandle (hObject=0x190) returned 1 [0192.788] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.789] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.789] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0192.789] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.789] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0192.789] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt")) returned 1 [0192.790] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TEW946CI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tew946ci.txt")) returned 0xffffffff [0192.790] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.791] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.791] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.799] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda [0192.799] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.800] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.808] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.859] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xda, lpOverlapped=0x0) returned 1 [0192.860] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xe0, lpOverlapped=0x0) returned 1 [0192.861] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.879] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.882] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.889] CloseHandle (hObject=0x190) returned 1 [0192.889] CloseHandle (hObject=0x19c) returned 1 [0192.889] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.890] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.890] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0192.890] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.890] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0192.890] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt")) returned 1 [0192.891] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\TFCJHLEI.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\tfcjhlei.txt")) returned 0xffffffff [0192.891] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.892] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.892] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.892] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0192.892] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.893] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0192.899] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0192.942] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6f, lpOverlapped=0x0) returned 1 [0192.965] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0192.966] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0192.981] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0192.985] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.992] CloseHandle (hObject=0x19c) returned 1 [0192.992] CloseHandle (hObject=0x190) returned 1 [0192.992] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0192.993] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0192.993] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0192.993] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0192.993] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0192.993] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt")) returned 1 [0192.994] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U2OYIS47.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u2oyis47.txt")) returned 0xffffffff [0192.994] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0192.995] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0192.995] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0192.995] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f [0192.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0192.996] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.002] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.045] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x6f, lpOverlapped=0x0) returned 1 [0193.046] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0193.047] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.062] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.066] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.073] CloseHandle (hObject=0x190) returned 1 [0193.073] CloseHandle (hObject=0x19c) returned 1 [0193.073] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.074] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.074] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0193.074] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.074] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0193.074] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt")) returned 1 [0193.075] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\U8FCPAKJ.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\u8fcpakj.txt")) returned 0xffffffff [0193.075] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.075] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.076] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.076] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54 [0193.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.077] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.083] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.126] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x54, lpOverlapped=0x0) returned 1 [0193.128] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0193.129] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.145] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.155] CloseHandle (hObject=0x19c) returned 1 [0193.155] CloseHandle (hObject=0x190) returned 1 [0193.155] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.156] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0193.156] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.156] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0193.156] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt")) returned 1 [0193.157] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBUPNOZC.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubupnozc.txt")) returned 0xffffffff [0193.157] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.158] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.158] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.158] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x69 [0193.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.159] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.165] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.304] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x69, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x69, lpOverlapped=0x0) returned 1 [0193.304] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x70, lpOverlapped=0x0) returned 1 [0193.606] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.627] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.631] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.640] CloseHandle (hObject=0x190) returned 1 [0193.640] CloseHandle (hObject=0x19c) returned 1 [0193.640] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.641] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.641] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0193.641] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.641] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0193.641] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt")) returned 1 [0193.642] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UBXQG39X.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ubxqg39x.txt")) returned 0xffffffff [0193.642] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.642] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.644] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.645] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x82 [0193.645] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.645] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.652] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.694] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x82, lpOverlapped=0x0) returned 1 [0193.694] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0193.695] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.710] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.714] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.721] CloseHandle (hObject=0x19c) returned 1 [0193.721] CloseHandle (hObject=0x190) returned 1 [0193.721] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.722] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.722] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0193.722] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.722] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0193.722] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt")) returned 1 [0193.723] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UGL14QS0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\ugl14qs0.txt")) returned 0xffffffff [0193.723] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.723] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.723] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.724] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22b [0193.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.724] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.732] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.773] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x22b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x22b, lpOverlapped=0x0) returned 1 [0193.780] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x230, lpOverlapped=0x0) returned 1 [0193.781] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.796] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.799] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.806] CloseHandle (hObject=0x190) returned 1 [0193.806] CloseHandle (hObject=0x19c) returned 1 [0193.806] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.807] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.807] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0193.807] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.807] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0193.807] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt")) returned 1 [0193.808] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\UUEVXDWP.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\uuevxdwp.txt")) returned 0xffffffff [0193.808] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.808] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.809] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.809] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x90 [0193.809] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.810] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.816] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.858] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x90, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x90, lpOverlapped=0x0) returned 1 [0193.858] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xa0, lpOverlapped=0x0) returned 1 [0193.859] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.875] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.878] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.885] CloseHandle (hObject=0x19c) returned 1 [0193.885] CloseHandle (hObject=0x190) returned 1 [0193.886] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.886] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.886] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0193.886] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.886] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0193.887] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt")) returned 1 [0193.887] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\V7NNCJHO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\v7nncjho.txt")) returned 0xffffffff [0193.887] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.888] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.888] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.889] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0193.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.889] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.896] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0193.939] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0xae, lpOverlapped=0x0) returned 1 [0193.940] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0xb0, lpOverlapped=0x0) returned 1 [0193.941] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0193.956] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0193.960] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.967] CloseHandle (hObject=0x190) returned 1 [0193.967] CloseHandle (hObject=0x19c) returned 1 [0193.967] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0193.968] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0193.968] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0193.968] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0193.968] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0193.968] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt")) returned 1 [0193.969] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\VD3GM2DA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\vd3gm2da.txt")) returned 0xffffffff [0193.969] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0193.970] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0193.970] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0193.971] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17c [0193.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0193.971] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0193.979] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.021] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x17c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x17c, lpOverlapped=0x0) returned 1 [0194.022] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x180, lpOverlapped=0x0) returned 1 [0194.023] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.038] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.042] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.049] CloseHandle (hObject=0x19c) returned 1 [0194.049] CloseHandle (hObject=0x190) returned 1 [0194.049] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.050] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.050] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0194.050] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.050] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0194.050] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt")) returned 1 [0194.051] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WPEXKTDV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wpexktdv.txt")) returned 0xffffffff [0194.051] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.051] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.051] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.052] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a [0194.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.053] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.061] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.102] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x16a, lpOverlapped=0x0) returned 1 [0194.103] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x170, lpOverlapped=0x0) returned 1 [0194.104] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.122] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.128] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.182] CloseHandle (hObject=0x190) returned 1 [0194.183] CloseHandle (hObject=0x19c) returned 1 [0194.183] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.184] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.184] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0194.184] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.184] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0194.184] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt")) returned 1 [0194.185] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WUT8M1Q8.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wut8m1q8.txt")) returned 0xffffffff [0194.185] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.185] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.186] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.186] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0194.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.187] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.193] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.313] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x11a, lpOverlapped=0x0) returned 1 [0194.313] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x120, lpOverlapped=0x0) returned 1 [0194.314] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.329] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.333] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.339] CloseHandle (hObject=0x19c) returned 1 [0194.339] CloseHandle (hObject=0x190) returned 1 [0194.339] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.340] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.340] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0194.340] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.340] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0194.341] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt")) returned 1 [0194.342] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\WX75TEOR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\wx75teor.txt")) returned 0xffffffff [0194.342] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.342] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.342] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.343] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x113 [0194.343] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.343] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.350] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.393] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x113, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x113, lpOverlapped=0x0) returned 1 [0194.394] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x120, lpOverlapped=0x0) returned 1 [0194.395] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.410] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.421] CloseHandle (hObject=0x190) returned 1 [0194.421] CloseHandle (hObject=0x19c) returned 1 [0194.421] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.421] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.422] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0194.422] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.422] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0194.422] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt")) returned 1 [0194.422] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XRS5D0N2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xrs5d0n2.txt")) returned 0xffffffff [0194.423] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.423] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.423] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.424] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e [0194.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.424] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.431] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.472] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5e, lpOverlapped=0x0) returned 1 [0194.473] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0194.473] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.489] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.500] CloseHandle (hObject=0x19c) returned 1 [0194.500] CloseHandle (hObject=0x190) returned 1 [0194.500] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.501] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0194.501] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.501] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0194.501] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt")) returned 1 [0194.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\XUAUK5R0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\xuauk5r0.txt")) returned 0xffffffff [0194.502] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.502] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.503] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d [0194.503] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.503] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.510] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.555] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5d, lpOverlapped=0x0) returned 1 [0194.556] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0194.557] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.572] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.576] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.583] CloseHandle (hObject=0x190) returned 1 [0194.583] CloseHandle (hObject=0x19c) returned 1 [0194.583] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.584] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.584] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0194.584] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.584] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0194.584] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt")) returned 1 [0194.585] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y1I415YS.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y1i415ys.txt")) returned 0xffffffff [0194.585] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.585] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.586] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.586] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a [0194.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.587] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.594] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.636] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ea44*=0x5a, lpOverlapped=0x0) returned 1 [0194.636] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0194.637] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.652] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.656] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.663] CloseHandle (hObject=0x19c) returned 1 [0194.663] CloseHandle (hObject=0x190) returned 1 [0194.664] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.664] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.664] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0194.665] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0194.665] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0194.665] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt")) returned 1 [0194.666] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\Y3XU5OKR.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\y3xu5okr.txt")) returned 0xffffffff [0194.666] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0194.666] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0194.666] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.666] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0194.666] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.667] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa1 [0194.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.667] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.674] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.719] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0xa1, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0xa1, lpOverlapped=0x0) returned 1 [0194.720] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0xb0, lpOverlapped=0x0) returned 1 [0194.721] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.736] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.740] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.746] CloseHandle (hObject=0x1a0) returned 1 [0194.746] CloseHandle (hObject=0x190) returned 1 [0194.746] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.747] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0194.748] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0194.748] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0194.748] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt")) returned 1 [0194.748] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\OOUVZSZN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\oouvzszn.txt")) returned 0xffffffff [0194.749] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.749] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0194.749] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.749] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.749] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534f00 [0194.749] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0194.749] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0194.749] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0194.749] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0194.749] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0194.749] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.749] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.750] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0194.750] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a [0194.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.751] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.757] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.805] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x7a, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x7a, lpOverlapped=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x80, lpOverlapped=0x0) returned 1 [0194.807] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.822] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.832] CloseHandle (hObject=0x190) returned 1 [0194.832] CloseHandle (hObject=0x1a0) returned 1 [0194.833] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.833] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.834] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0194.834] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0194.834] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0194.834] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt")) returned 1 [0194.834] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\TIGZFGLM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\tigzfglm.txt")) returned 0xffffffff [0194.835] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.835] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0194.835] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0194.836] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x75 [0194.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.836] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.843] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0194.885] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x75, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x75, lpOverlapped=0x0) returned 1 [0194.886] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x80, lpOverlapped=0x0) returned 1 [0194.887] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0194.902] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0194.906] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.912] CloseHandle (hObject=0x1a0) returned 1 [0194.912] CloseHandle (hObject=0x190) returned 1 [0194.913] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.913] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0194.913] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0194.914] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0194.914] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0194.914] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt")) returned 1 [0194.914] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\XNW1G0SM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcookies\\xnw1g0sm.txt")) returned 0xffffffff [0194.914] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0194.915] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0194.915] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0194.915] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0194.915] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.915] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.915] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0194.915] CloseHandle (hObject=0xffffffff) returned 1 [0194.915] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0194.915] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0194.915] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0194.915] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0194.915] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0194.915] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat")) returned 0 [0194.916] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat")) returned 0x20 [0194.916] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0194.916] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0194.916] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.916] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0194.916] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0194.916] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0194.958] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0194.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0194.959] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0194.965] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.007] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x10, lpOverlapped=0x0) returned 1 [0195.008] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.025] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.029] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.036] CloseHandle (hObject=0x1a0) returned 1 [0195.036] CloseHandle (hObject=0x19c) returned 1 [0195.036] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.037] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.037] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0195.037] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.037] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0195.037] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg")) returned 1 [0195.038] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\16f3f148.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\16f3f148.jpg")) returned 0xffffffff [0195.038] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.038] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.038] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.039] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10a9 [0195.039] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.039] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.047] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.088] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x10a9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x10a9, lpOverlapped=0x0) returned 1 [0195.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x10b0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x10b0, lpOverlapped=0x0) returned 1 [0195.231] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.247] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.251] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.257] CloseHandle (hObject=0x19c) returned 1 [0195.258] CloseHandle (hObject=0x1a0) returned 1 [0195.258] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.258] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.259] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0195.259] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.259] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0195.259] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg")) returned 1 [0195.260] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\179e8db5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\179e8db5.jpg")) returned 0xffffffff [0195.260] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.260] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.260] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.261] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bc5 [0195.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.261] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.269] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.310] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1bc5, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1bc5, lpOverlapped=0x0) returned 1 [0195.455] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1bd0, lpOverlapped=0x0) returned 1 [0195.456] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.471] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.475] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.481] CloseHandle (hObject=0x1a0) returned 1 [0195.482] CloseHandle (hObject=0x19c) returned 1 [0195.482] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.483] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.483] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0195.483] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.483] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0195.483] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg")) returned 1 [0195.484] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ad75057.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ad75057.jpg")) returned 0xffffffff [0195.484] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.484] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.484] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.485] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2045 [0195.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.485] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.492] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.534] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x2045, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x2045, lpOverlapped=0x0) returned 1 [0195.639] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x2050, lpOverlapped=0x0) returned 1 [0195.640] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.656] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.659] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.665] CloseHandle (hObject=0x19c) returned 1 [0195.666] CloseHandle (hObject=0x1a0) returned 1 [0195.666] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.666] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.666] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0195.667] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.667] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0195.667] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg")) returned 1 [0195.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1ba49cb8.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1ba49cb8.jpg")) returned 0xffffffff [0195.668] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.668] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.670] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.670] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ac [0195.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.670] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.677] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.725] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x18ac, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x18ac, lpOverlapped=0x0) returned 1 [0195.726] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x18b0, lpOverlapped=0x0) returned 1 [0195.727] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.741] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.745] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.752] CloseHandle (hObject=0x1a0) returned 1 [0195.752] CloseHandle (hObject=0x19c) returned 1 [0195.752] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.753] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.753] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0195.753] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.753] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0195.753] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg")) returned 1 [0195.754] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\1f43fcc4.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\1f43fcc4.jpg")) returned 0xffffffff [0195.754] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.754] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.755] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d8e [0195.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.755] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.762] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.808] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1d8e, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1d8e, lpOverlapped=0x0) returned 1 [0195.811] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1d90, lpOverlapped=0x0) returned 1 [0195.812] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.828] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.831] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.839] CloseHandle (hObject=0x19c) returned 1 [0195.839] CloseHandle (hObject=0x1a0) returned 1 [0195.839] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.840] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.840] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0195.840] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.840] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0195.840] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg")) returned 1 [0195.841] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\23a8b33e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\23a8b33e.jpg")) returned 0xffffffff [0195.841] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.841] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.841] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.842] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dd6 [0195.842] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.842] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.849] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.896] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1dd6, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1dd6, lpOverlapped=0x0) returned 1 [0195.913] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1de0, lpOverlapped=0x0) returned 1 [0195.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0195.930] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0195.933] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.940] CloseHandle (hObject=0x1a0) returned 1 [0195.940] CloseHandle (hObject=0x19c) returned 1 [0195.943] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0195.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0195.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0195.944] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0195.944] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0195.944] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg")) returned 1 [0195.945] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\34b2700e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\34b2700e.jpg")) returned 0xffffffff [0195.945] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0195.945] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0195.946] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0195.946] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176f [0195.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0195.947] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0195.954] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0195.998] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x176f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x176f, lpOverlapped=0x0) returned 1 [0196.292] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1770, lpOverlapped=0x0) returned 1 [0196.294] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0196.317] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0196.322] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.329] CloseHandle (hObject=0x19c) returned 1 [0196.329] CloseHandle (hObject=0x1a0) returned 1 [0196.329] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0196.330] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0196.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0196.330] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0196.330] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0196.330] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg")) returned 1 [0196.331] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\3d12749e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\3d12749e.jpg")) returned 0xffffffff [0196.331] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0196.331] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0196.331] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0196.332] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194b [0196.332] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0196.332] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0196.339] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0196.396] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x194b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x194b, lpOverlapped=0x0) returned 1 [0196.558] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1950, lpOverlapped=0x0) returned 1 [0196.559] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0196.576] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0196.579] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.586] CloseHandle (hObject=0x1a0) returned 1 [0196.586] CloseHandle (hObject=0x19c) returned 1 [0196.586] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0196.587] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0196.587] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0196.587] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0196.587] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0196.587] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg")) returned 1 [0196.588] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\434a4949.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\434a4949.jpg")) returned 0xffffffff [0196.588] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0196.588] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0196.589] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0196.589] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20cc [0196.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0196.590] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0196.597] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0196.640] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x20cc, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x20cc, lpOverlapped=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x20d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x20d0, lpOverlapped=0x0) returned 1 [0196.712] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0196.727] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0196.731] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.738] CloseHandle (hObject=0x19c) returned 1 [0196.738] CloseHandle (hObject=0x1a0) returned 1 [0196.738] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0196.739] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0196.739] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0196.739] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0196.739] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0196.739] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg")) returned 1 [0196.740] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4929c482.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4929c482.jpg")) returned 0xffffffff [0196.740] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0196.740] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0196.741] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0196.768] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10ef [0196.768] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0196.768] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0196.775] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0196.824] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x10ef, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x10ef, lpOverlapped=0x0) returned 1 [0196.939] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x10f0, lpOverlapped=0x0) returned 1 [0196.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0196.955] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0196.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.966] CloseHandle (hObject=0x1a0) returned 1 [0196.966] CloseHandle (hObject=0x19c) returned 1 [0196.966] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0196.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0196.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0196.967] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0196.967] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0196.967] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg")) returned 1 [0196.968] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\4a7a41cb.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\4a7a41cb.jpg")) returned 0xffffffff [0196.968] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0196.968] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0196.969] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0196.969] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15d1 [0196.969] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0196.970] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0196.977] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0197.145] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x15d1, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x15d1, lpOverlapped=0x0) returned 1 [0197.445] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x15e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x15e0, lpOverlapped=0x0) returned 1 [0197.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0197.462] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0197.467] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.473] CloseHandle (hObject=0x19c) returned 1 [0197.473] CloseHandle (hObject=0x1a0) returned 1 [0197.473] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0197.474] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0197.474] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0197.474] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0197.474] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0197.474] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg")) returned 1 [0197.475] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\52572b1f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\52572b1f.jpg")) returned 0xffffffff [0197.475] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0197.476] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0197.476] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0197.477] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1a [0197.477] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0197.477] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0197.484] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0197.527] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0xf1a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0xf1a, lpOverlapped=0x0) returned 1 [0197.701] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0xf20, lpOverlapped=0x0) returned 1 [0197.702] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0197.720] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0197.724] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.730] CloseHandle (hObject=0x1a0) returned 1 [0197.730] CloseHandle (hObject=0x19c) returned 1 [0197.730] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0197.731] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0197.731] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0197.731] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0197.732] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0197.732] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg")) returned 1 [0197.732] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\6b492b11.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\6b492b11.jpg")) returned 0xffffffff [0197.732] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0197.733] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0197.733] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0197.734] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b8 [0197.734] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0197.734] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0197.741] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0197.796] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x17b8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x17b8, lpOverlapped=0x0) returned 1 [0197.858] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x17c0, lpOverlapped=0x0) returned 1 [0197.859] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0197.881] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0197.886] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.893] CloseHandle (hObject=0x19c) returned 1 [0197.893] CloseHandle (hObject=0x1a0) returned 1 [0197.894] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0197.895] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0197.895] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0197.895] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0197.895] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0197.895] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg")) returned 1 [0197.896] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7a7d9912.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7a7d9912.jpg")) returned 0xffffffff [0197.896] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0197.896] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0197.897] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0197.897] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18d1 [0197.897] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0197.898] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0197.905] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0197.946] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x18d1, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x18d1, lpOverlapped=0x0) returned 1 [0198.162] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x18e0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x18e0, lpOverlapped=0x0) returned 1 [0198.162] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0198.179] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0198.183] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.190] CloseHandle (hObject=0x1a0) returned 1 [0198.190] CloseHandle (hObject=0x19c) returned 1 [0198.190] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0198.191] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0198.191] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0198.191] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0198.191] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0198.191] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg")) returned 1 [0198.192] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7b9a0c9a.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7b9a0c9a.jpg")) returned 0xffffffff [0198.192] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0198.192] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0198.193] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0198.194] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1949 [0198.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0198.194] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0198.244] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0198.288] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1949, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1949, lpOverlapped=0x0) returned 1 [0198.396] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1950, lpOverlapped=0x0) returned 1 [0198.397] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0198.413] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0198.416] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.424] CloseHandle (hObject=0x19c) returned 1 [0198.424] CloseHandle (hObject=0x1a0) returned 1 [0198.424] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0198.425] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0198.425] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0198.425] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0198.425] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0198.425] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg")) returned 1 [0198.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7cbffa6f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7cbffa6f.jpg")) returned 0xffffffff [0198.426] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0198.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0198.426] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0198.430] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194b [0198.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0198.430] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0198.437] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0198.479] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x194b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x194b, lpOverlapped=0x0) returned 1 [0198.677] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1950, lpOverlapped=0x0) returned 1 [0198.678] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0198.695] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0198.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.706] CloseHandle (hObject=0x1a0) returned 1 [0198.707] CloseHandle (hObject=0x19c) returned 1 [0198.707] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0198.708] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0198.708] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0198.708] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0198.708] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0198.708] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg")) returned 1 [0198.709] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\7fe97f77.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\7fe97f77.jpg")) returned 0xffffffff [0198.709] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0198.709] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0199.005] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0199.006] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e86 [0199.006] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0199.006] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0199.013] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0199.056] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x7e86, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x7e86, lpOverlapped=0x0) returned 1 [0199.344] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x7e90, lpOverlapped=0x0) returned 1 [0199.345] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0199.361] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0199.365] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.372] CloseHandle (hObject=0x19c) returned 1 [0199.372] CloseHandle (hObject=0x1a0) returned 1 [0199.372] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0199.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0199.373] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0199.373] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0199.373] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0199.373] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg")) returned 1 [0199.374] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\9c14e2ad.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\9c14e2ad.jpg")) returned 0xffffffff [0199.374] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0199.374] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0199.374] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0199.375] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1236 [0199.375] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0199.375] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0199.383] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0199.427] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1236, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1236, lpOverlapped=0x0) returned 1 [0199.493] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1240, lpOverlapped=0x0) returned 1 [0199.837] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0199.853] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0199.857] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.864] CloseHandle (hObject=0x1a0) returned 1 [0199.864] CloseHandle (hObject=0x19c) returned 1 [0199.864] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0199.865] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0199.865] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0199.865] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0199.865] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0199.865] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg")) returned 1 [0199.866] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a1444597.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a1444597.jpg")) returned 0xffffffff [0199.866] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0199.867] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0199.867] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0199.868] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b4 [0199.868] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0199.868] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0199.875] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0199.920] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x10b4, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x10b4, lpOverlapped=0x0) returned 1 [0199.998] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x10c0, lpOverlapped=0x0) returned 1 [0199.998] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0200.014] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0200.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.024] CloseHandle (hObject=0x19c) returned 1 [0200.024] CloseHandle (hObject=0x1a0) returned 1 [0200.024] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0200.025] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0200.025] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0200.026] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0200.026] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0200.026] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg")) returned 1 [0200.026] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a229ed41.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a229ed41.jpg")) returned 0xffffffff [0200.027] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0200.027] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0200.027] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0200.028] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12fd [0200.028] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0200.028] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0200.036] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0200.174] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x12fd, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x12fd, lpOverlapped=0x0) returned 1 [0200.206] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1300, lpOverlapped=0x0) returned 1 [0200.206] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0200.383] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0200.387] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.393] CloseHandle (hObject=0x1a0) returned 1 [0200.394] CloseHandle (hObject=0x19c) returned 1 [0200.394] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0200.395] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0200.395] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0200.395] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0200.395] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0200.395] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg")) returned 1 [0200.396] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a271c2fa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a271c2fa.jpg")) returned 0xffffffff [0200.396] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0200.396] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0200.396] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0200.397] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x260b [0200.397] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0200.397] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0200.404] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0200.447] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x260b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x260b, lpOverlapped=0x0) returned 1 [0200.676] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x2610, lpOverlapped=0x0) returned 1 [0200.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0200.692] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0200.696] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.703] CloseHandle (hObject=0x19c) returned 1 [0200.703] CloseHandle (hObject=0x1a0) returned 1 [0200.703] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0200.704] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0200.704] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0200.704] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0200.704] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0200.704] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg")) returned 1 [0200.706] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\a2e35824.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\a2e35824.jpg")) returned 0xffffffff [0200.706] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0200.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0200.706] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0200.707] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bd7 [0200.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0200.708] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0200.714] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0200.761] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1bd7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1bd7, lpOverlapped=0x0) returned 1 [0200.807] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1be0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1be0, lpOverlapped=0x0) returned 1 [0200.808] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0200.824] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0200.828] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.835] CloseHandle (hObject=0x1a0) returned 1 [0200.835] CloseHandle (hObject=0x19c) returned 1 [0200.835] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0200.836] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0200.837] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0200.837] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0200.837] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0200.837] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg")) returned 1 [0200.838] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\c00de09f.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\c00de09f.jpg")) returned 0xffffffff [0200.838] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0200.838] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0200.839] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0200.839] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2035 [0200.839] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0200.839] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0200.846] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0200.891] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x2035, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x2035, lpOverlapped=0x0) returned 1 [0200.946] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x2040, lpOverlapped=0x0) returned 1 [0200.947] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0200.963] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0200.967] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.973] CloseHandle (hObject=0x19c) returned 1 [0200.974] CloseHandle (hObject=0x1a0) returned 1 [0200.974] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0200.974] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0200.975] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0200.975] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0200.975] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0200.975] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg")) returned 1 [0200.976] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cc2f5fc7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cc2f5fc7.jpg")) returned 0xffffffff [0200.976] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0200.976] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0200.976] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0200.977] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1407 [0200.977] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0200.977] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0200.984] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0201.030] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1407, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1407, lpOverlapped=0x0) returned 1 [0201.079] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1410, lpOverlapped=0x0) returned 1 [0201.079] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0201.095] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0201.098] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.105] CloseHandle (hObject=0x1a0) returned 1 [0201.105] CloseHandle (hObject=0x19c) returned 1 [0201.106] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0201.106] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0201.107] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0201.107] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0201.107] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0201.107] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg")) returned 1 [0201.108] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\cf6a15d.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\cf6a15d.jpg")) returned 0xffffffff [0201.108] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0201.108] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0201.108] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0201.109] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x162a [0201.109] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0201.109] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0201.116] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0201.710] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x162a, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x162a, lpOverlapped=0x0) returned 1 [0201.711] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1630, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1630, lpOverlapped=0x0) returned 1 [0201.712] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0201.727] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0201.731] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.738] CloseHandle (hObject=0x19c) returned 1 [0201.738] CloseHandle (hObject=0x1a0) returned 1 [0201.738] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0201.739] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0201.739] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0201.739] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0201.739] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0201.739] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg")) returned 1 [0201.740] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d365e9d1.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d365e9d1.jpg")) returned 0xffffffff [0201.740] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0201.741] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0201.741] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0201.743] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b55 [0201.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0201.743] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0201.750] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0201.763] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1b55, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1b55, lpOverlapped=0x0) returned 1 [0201.764] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1b60, lpOverlapped=0x0) returned 1 [0201.764] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0201.779] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0201.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.789] CloseHandle (hObject=0x1a0) returned 1 [0201.789] CloseHandle (hObject=0x19c) returned 1 [0201.789] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0201.790] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0201.790] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0201.790] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0201.790] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0201.790] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg")) returned 1 [0201.796] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\d83532fe.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\d83532fe.jpg")) returned 0xffffffff [0201.796] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0201.796] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0201.797] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0201.797] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c8 [0201.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0201.798] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0201.804] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0201.818] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x10c8, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x10c8, lpOverlapped=0x0) returned 1 [0201.819] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x10d0, lpOverlapped=0x0) returned 1 [0201.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0201.835] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0201.838] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.845] CloseHandle (hObject=0x19c) returned 1 [0201.845] CloseHandle (hObject=0x1a0) returned 1 [0201.845] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0201.846] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0201.846] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0201.846] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0201.846] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0201.846] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg")) returned 1 [0201.847] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\da8e59e.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\da8e59e.jpg")) returned 0xffffffff [0201.847] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0201.847] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0201.847] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0201.848] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1adb [0201.848] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0201.848] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0201.855] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0201.869] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1adb, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1adb, lpOverlapped=0x0) returned 1 [0201.914] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1ae0, lpOverlapped=0x0) returned 1 [0201.915] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0201.930] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0201.934] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.941] CloseHandle (hObject=0x1a0) returned 1 [0201.941] CloseHandle (hObject=0x19c) returned 1 [0201.941] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0201.942] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0201.942] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0201.942] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0201.942] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0201.942] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg")) returned 1 [0201.943] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\dab752aa.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\dab752aa.jpg")) returned 0xffffffff [0201.943] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0201.943] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0201.944] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0201.945] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x163f [0201.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0201.945] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0201.952] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0201.967] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x163f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x163f, lpOverlapped=0x0) returned 1 [0202.428] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1640, lpOverlapped=0x0) returned 1 [0202.429] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0202.444] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0202.448] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.454] CloseHandle (hObject=0x19c) returned 1 [0202.454] CloseHandle (hObject=0x1a0) returned 1 [0202.454] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0202.455] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0202.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0202.455] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0202.455] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0202.456] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg")) returned 1 [0202.456] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f466753.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f466753.jpg")) returned 0xffffffff [0202.456] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0202.457] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0202.457] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0202.457] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x160f [0202.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0202.458] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0202.465] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0202.485] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x160f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x160f, lpOverlapped=0x0) returned 1 [0202.554] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1610, lpOverlapped=0x0) returned 1 [0202.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0202.570] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0202.574] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.581] CloseHandle (hObject=0x1a0) returned 1 [0202.581] CloseHandle (hObject=0x19c) returned 1 [0202.581] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0202.582] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0202.582] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0202.582] FindNextFileA (in: hFindFile=0x534cc0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0202.582] FindClose (in: hFindFile=0x534cc0 | out: hFindFile=0x534cc0) returned 1 [0202.582] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg")) returned 1 [0202.583] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f4b839c7.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f4b839c7.jpg")) returned 0xffffffff [0202.583] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0202.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0202.583] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0202.584] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ad9 [0202.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0202.584] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0202.591] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0202.611] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1ad9, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1ad9, lpOverlapped=0x0) returned 1 [0202.677] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1ae0, lpOverlapped=0x0) returned 1 [0202.678] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0202.694] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0202.698] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.705] CloseHandle (hObject=0x19c) returned 1 [0202.705] CloseHandle (hObject=0x1a0) returned 1 [0202.705] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0202.706] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0202.706] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0202.706] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0202.706] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0202.706] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg")) returned 1 [0202.707] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f67a62c3.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f67a62c3.jpg")) returned 0xffffffff [0202.707] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0202.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0202.707] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0202.708] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1358 [0202.708] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0202.708] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0202.717] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0202.737] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1358, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1358, lpOverlapped=0x0) returned 1 [0202.789] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1360, lpOverlapped=0x0) returned 1 [0202.798] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0202.817] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0202.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.828] CloseHandle (hObject=0x1a0) returned 1 [0202.828] CloseHandle (hObject=0x19c) returned 1 [0202.828] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0202.829] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0202.829] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0202.829] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0202.829] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0202.829] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg")) returned 1 [0202.830] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f76d6757.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f76d6757.jpg")) returned 0xffffffff [0202.830] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0202.830] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0202.830] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0202.831] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b2b [0202.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0202.831] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0202.838] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0202.859] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x1b2b, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x1b2b, lpOverlapped=0x0) returned 1 [0202.905] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x1b30, lpOverlapped=0x0) returned 1 [0202.905] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0202.921] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0202.924] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.931] CloseHandle (hObject=0x19c) returned 1 [0202.931] CloseHandle (hObject=0x1a0) returned 1 [0202.931] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0202.933] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0202.933] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0202.933] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0202.933] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0202.933] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg")) returned 1 [0202.934] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\f7f275e5.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\f7f275e5.jpg")) returned 0xffffffff [0202.934] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0202.935] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0202.935] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0202.935] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24e3 [0202.935] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0202.936] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0202.943] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0202.963] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47048, nNumberOfBytesToRead=0x24e3, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesRead=0x19ea44*=0x24e3, lpOverlapped=0x0) returned 1 [0203.057] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47048*, nNumberOfBytesToWrite=0x24f0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47048*, lpNumberOfBytesWritten=0x19ea44*=0x24f0, lpOverlapped=0x0) returned 1 [0203.058] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.073] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.077] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.083] CloseHandle (hObject=0x1a0) returned 1 [0203.083] CloseHandle (hObject=0x19c) returned 1 [0203.083] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.084] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0203.084] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0203.084] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0203.084] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0203.084] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg")) returned 1 [0203.085] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Notifications\\wpnidm\\fb970b75.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\notifications\\wpnidm\\fb970b75.jpg")) returned 0xffffffff [0203.085] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.085] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0203.085] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.086] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.086] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.086] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.086] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534f40 [0203.086] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.086] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.086] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\CommandAnalysis\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.088] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.088] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.088] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.089] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.090] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.090] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.091] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.092] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.092] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.092] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.093] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.093] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0203.093] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.093] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0203.094] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.095] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.095] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\1079934665\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0203.095] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.095] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.096] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.096] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.096] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.096] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\1605653898\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0203.096] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.096] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.097] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.097] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.097] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.097] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\1978304864\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0203.097] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.097] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.098] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.098] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.098] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.098] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\2107319684\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0203.098] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.098] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.099] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.099] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0203.099] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.099] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\226732975\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535200 [0203.099] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.099] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.100] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.100] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0203.100] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.100] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\2570292521\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.100] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.101] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.101] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.101] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.101] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.101] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\2577507833\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.101] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.101] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.102] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.102] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.102] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.102] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\2646675675\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0203.102] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.102] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.103] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.103] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0203.103] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.103] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3053798886\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.103] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.103] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.104] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.104] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.104] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.104] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3295484897\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.104] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.104] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.105] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.105] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.105] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.105] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3375042201\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0203.105] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.105] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.106] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.106] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.106] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.106] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3530508098\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0203.106] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.106] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.107] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.107] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0203.107] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.107] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3705566220\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534f40 [0203.107] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.107] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.107] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.108] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0203.108] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.108] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3779757838\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0203.108] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.108] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.108] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.108] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.108] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.108] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\3782802250\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0203.109] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.109] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.109] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.109] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0203.109] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.109] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\860568095\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.110] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.110] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.110] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.110] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.110] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.110] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.111] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.111] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.111] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\3779757838\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e80 [0203.111] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.111] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.111] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.111] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.111] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.111] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.112] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.112] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.112] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.112] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.112] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\3053798886\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0203.112] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.112] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.113] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.113] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0203.113] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.113] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.113] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.113] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0203.113] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.113] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.113] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\3782802250\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534d00 [0203.113] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.113] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.113] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.113] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0203.114] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.114] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0203.114] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.114] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0203.114] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.114] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.114] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\1978304864\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e80 [0203.114] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.114] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.115] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.115] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.115] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.115] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.115] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.115] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535240 [0203.115] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.115] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.115] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\1605653898\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x5351c0 [0203.115] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.116] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.116] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.116] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.116] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.116] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0203.116] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.116] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0203.116] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.116] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.116] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\226732975\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535200 [0203.117] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.117] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.117] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.117] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0203.117] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.117] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0203.117] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.117] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535040 [0203.118] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.118] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.118] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3705566220\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535080 [0203.118] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.118] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.119] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.119] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0203.119] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.119] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0203.119] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.119] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535300 [0203.119] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.119] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.119] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2577507833\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e80 [0203.119] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.119] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.119] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.120] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.120] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.120] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534c80 [0203.120] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.120] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\3530508098\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535040 [0203.120] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.120] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.120] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0203.121] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.121] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0203.121] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.121] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0203.121] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.121] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.121] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2570292521\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x5351c0 [0203.121] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.121] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.122] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.122] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.122] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.122] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.122] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.122] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534e80 [0203.122] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.122] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.122] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3295484897\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535200 [0203.122] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.122] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.123] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.123] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0203.123] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.123] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.123] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.123] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535400 [0203.123] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.123] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.123] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\3375042201\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534c80 [0203.123] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.124] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.124] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.124] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0203.124] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.124] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0203.124] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.124] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.125] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.125] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.125] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\2107319684\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e80 [0203.125] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.125] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.125] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.125] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.125] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.125] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.125] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.125] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0203.126] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.126] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\860568095\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x5353c0 [0203.126] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.126] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.126] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.126] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0203.126] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.126] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.126] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x535380 [0203.127] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.127] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.127] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\2646675675\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x535300 [0203.127] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.127] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.127] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.128] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0203.128] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.128] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.128] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5351c0 [0203.128] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.128] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.128] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\PRICache\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\1079934665\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534c80 [0203.128] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.128] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0 [0203.129] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.129] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.129] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.129] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0203.129] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.129] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.129] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\RoamingTiles\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0203.129] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.129] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.129] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.129] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Shell\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534d00 [0203.130] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.130] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.130] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.130] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0203.131] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.131] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0xffffffff [0203.131] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.131] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.131] CloseHandle (hObject=0xffffffff) returned 1 [0203.131] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.131] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0203.131] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0203.132] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0203.132] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0203.132] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0 [0203.132] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0x22 [0203.132] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.132] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.133] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.133] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.134] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.135] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.135] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535300 [0203.135] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.135] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.135] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0203.135] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0203.136] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0203.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0203.136] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0203.143] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0203.160] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x2000, lpOverlapped=0x0) returned 1 [0203.160] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x2010, lpOverlapped=0x0) returned 1 [0203.161] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.176] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.179] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.187] CloseHandle (hObject=0x190) returned 1 [0203.187] CloseHandle (hObject=0x19c) returned 1 [0203.187] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.188] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0203.188] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0203.188] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.188] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0203.188] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk")) returned 1 [0203.189] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.chk")) returned 0xffffffff [0203.189] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.190] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.190] CloseHandle (hObject=0xffffffff) returned 1 [0203.190] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.190] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0203.190] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0203.190] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.190] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.190] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log")) returned 0 [0203.190] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01.log")) returned 0x2020 [0203.190] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.191] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0203.191] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0203.191] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0203.191] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0203.192] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0203.198] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0203.237] ReadFile (in: hFile=0x19c, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x80000, lpOverlapped=0x0) returned 1 [0203.247] WriteFile (in: hFile=0x190, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x80010, lpOverlapped=0x0) returned 1 [0203.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.388] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.399] CloseHandle (hObject=0x19c) returned 1 [0203.399] CloseHandle (hObject=0x190) returned 1 [0203.399] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.400] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0203.400] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0203.400] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.400] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0203.400] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log")) returned 1 [0203.404] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002C.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002c.log")) returned 0xffffffff [0203.404] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.404] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0203.404] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0203.405] GetFileSize (in: hFile=0x190, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0203.405] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0203.405] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0203.412] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0203.433] ReadFile (in: hFile=0x190, lpBuffer=0x1d4700c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesRead=0x19ecac*=0x80000, lpOverlapped=0x0) returned 1 [0203.477] WriteFile (in: hFile=0x19c, lpBuffer=0x1d4700c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d4700c*, lpNumberOfBytesWritten=0x19ecac*=0x80010, lpOverlapped=0x0) returned 1 [0203.486] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.505] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.509] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.516] CloseHandle (hObject=0x190) returned 1 [0203.516] CloseHandle (hObject=0x19c) returned 1 [0203.517] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.517] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0203.518] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0203.518] FindNextFileA (in: hFindFile=0x535080, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.518] FindClose (in: hFindFile=0x535080 | out: hFindFile=0x535080) returned 1 [0203.518] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log")) returned 1 [0203.521] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V010002D.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v010002d.log")) returned 0xffffffff [0203.521] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.522] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.522] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.522] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.522] CloseHandle (hObject=0xffffffff) returned 1 [0203.523] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.523] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0203.523] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0203.523] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.523] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0203.523] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log")) returned 0 [0203.523] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\V01tmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\v01tmp.log")) returned 0x2020 [0203.523] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.523] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.523] CloseHandle (hObject=0xffffffff) returned 1 [0203.523] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.524] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0203.524] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0203.524] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.524] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0203.524] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")) returned 0 [0203.524] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat")) returned 0x2020 [0203.524] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.524] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0203.524] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.524] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcachelock.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0203.524] CloseHandle (hObject=0xffffffff) returned 1 [0203.524] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcachelock.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcachelock.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.525] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcachelock.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0203.525] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0203.525] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0203.525] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0203.525] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcachelock.dat")) returned 0 [0203.525] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WebCacheLock.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\webcachelock.dat")) returned 0x26 [0203.525] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.525] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0203.525] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.525] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0203.526] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0203.640] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xac34 [0203.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0203.640] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0203.647] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0203.663] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47050, nNumberOfBytesToRead=0xac34, lpNumberOfBytesRead=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47050*, lpNumberOfBytesRead=0x19ecac*=0xac34, lpOverlapped=0x0) returned 1 [0203.734] WriteFile (in: hFile=0x190, lpBuffer=0x1d47050*, nNumberOfBytesToWrite=0xac40, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47050*, lpNumberOfBytesWritten=0x19ecac*=0xac40, lpOverlapped=0x0) returned 1 [0203.736] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.751] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.755] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.762] CloseHandle (hObject=0x19c) returned 1 [0203.762] CloseHandle (hObject=0x190) returned 1 [0203.762] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.763] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0203.763] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0203.763] FindNextFileA (in: hFindFile=0x534f40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0203.763] FindClose (in: hFindFile=0x534f40 | out: hFindFile=0x534f40) returned 1 [0203.764] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log")) returned 1 [0203.765] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Windows Anytime Upgrade\\Upgrade_dism.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\windows anytime upgrade\\upgrade_dism.log")) returned 0xffffffff [0203.765] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0203.765] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0203.765] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0203.765] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0203.765] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.765] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.765] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534d00 [0203.765] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.766] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.766] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0203.766] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0203.767] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0203.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0203.767] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0203.777] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0203.800] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x455, lpOverlapped=0x0) returned 1 [0203.801] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x460, lpOverlapped=0x0) returned 1 [0203.802] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.817] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.828] CloseHandle (hObject=0x19c) returned 1 [0203.828] CloseHandle (hObject=0x1a0) returned 1 [0203.828] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.829] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0203.829] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0203.829] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0203.829] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0203.829] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk")) returned 1 [0203.830] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\1 - Desktop.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\1 - desktop.lnk")) returned 0xffffffff [0203.830] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0203.830] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0203.831] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0203.918] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51 [0203.918] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0203.918] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0203.925] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0203.945] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x51, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x51, lpOverlapped=0x0) returned 1 [0203.946] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x60, lpOverlapped=0x0) returned 1 [0203.947] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0203.967] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0203.971] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.977] CloseHandle (hObject=0x1a0) returned 1 [0203.978] CloseHandle (hObject=0x19c) returned 1 [0203.978] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0203.979] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0203.979] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0203.979] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0203.979] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0203.979] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini")) returned 1 [0203.980] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group1\\desktop.ini")) returned 0xffffffff [0203.980] FindNextFileA (in: hFindFile=0x534d00, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0203.980] FindClose (in: hFindFile=0x534d00 | out: hFindFile=0x534d00) returned 1 [0203.980] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0203.980] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0204.104] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.104] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.104] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0204.104] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0204.105] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0204.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0204.105] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0204.112] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0204.131] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x455, lpOverlapped=0x0) returned 1 [0204.277] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x460, lpOverlapped=0x0) returned 1 [0204.278] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0204.296] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0204.300] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.307] CloseHandle (hObject=0x19c) returned 1 [0204.307] CloseHandle (hObject=0x1a0) returned 1 [0204.482] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0204.485] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0204.485] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0204.485] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0204.485] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0204.485] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk")) returned 1 [0204.486] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\1 - Run.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\1 - run.lnk")) returned 0xffffffff [0204.486] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.486] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0204.486] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0204.487] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0204.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0204.487] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0204.494] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0204.506] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x455, lpOverlapped=0x0) returned 1 [0204.610] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x460, lpOverlapped=0x0) returned 1 [0204.611] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0204.626] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0204.630] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.636] CloseHandle (hObject=0x1a0) returned 1 [0204.636] CloseHandle (hObject=0x19c) returned 1 [0204.637] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0204.637] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0204.637] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0204.638] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0204.638] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0204.638] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk")) returned 1 [0204.638] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\2 - Search.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\2 - search.lnk")) returned 0xffffffff [0204.638] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.639] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0204.639] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0204.639] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x455 [0204.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0204.640] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0204.647] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0204.659] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x455, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x455, lpOverlapped=0x0) returned 1 [0204.787] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x460, lpOverlapped=0x0) returned 1 [0204.788] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0204.809] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0204.813] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.820] CloseHandle (hObject=0x19c) returned 1 [0204.820] CloseHandle (hObject=0x1a0) returned 1 [0204.820] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0204.821] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0204.821] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0204.821] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0204.821] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0204.822] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk")) returned 1 [0204.822] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\3 - Windows Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\3 - windows explorer.lnk")) returned 0xffffffff [0204.822] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.823] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0204.823] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0204.824] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0204.824] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0204.824] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0204.831] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0204.844] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3f7, lpOverlapped=0x0) returned 1 [0204.845] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0204.846] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0204.861] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0204.865] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.873] CloseHandle (hObject=0x1a0) returned 1 [0204.873] CloseHandle (hObject=0x19c) returned 1 [0204.873] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0204.874] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0204.875] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0204.875] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0204.875] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0204.875] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk")) returned 1 [0204.876] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\4 - Control Panel.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\4 - control panel.lnk")) returned 0xffffffff [0204.876] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.876] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0204.876] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0204.877] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fd [0204.877] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0204.877] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0204.884] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0204.897] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3fd, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3fd, lpOverlapped=0x0) returned 1 [0204.898] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0204.899] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0204.914] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0204.918] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.925] CloseHandle (hObject=0x19c) returned 1 [0204.925] CloseHandle (hObject=0x1a0) returned 1 [0204.925] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0204.926] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0204.926] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0204.926] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0204.926] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0204.926] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk")) returned 1 [0204.927] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\5 - Task Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\5 - task manager.lnk")) returned 0xffffffff [0204.927] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0204.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0204.927] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0204.928] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c [0204.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0204.928] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0204.936] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0204.989] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x14c, lpOverlapped=0x0) returned 1 [0204.990] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x150, lpOverlapped=0x0) returned 1 [0204.991] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.007] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.039] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.046] CloseHandle (hObject=0x1a0) returned 1 [0205.046] CloseHandle (hObject=0x19c) returned 1 [0205.046] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.047] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.047] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0205.048] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.048] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0205.048] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini")) returned 1 [0205.049] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group2\\desktop.ini")) returned 0xffffffff [0205.049] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0205.049] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0205.049] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0205.049] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x534ec0 [0205.050] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.050] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.051] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.051] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.052] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0205.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.052] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0205.059] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0205.071] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3f7, lpOverlapped=0x0) returned 1 [0205.074] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0205.075] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.090] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.094] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.101] CloseHandle (hObject=0x19c) returned 1 [0205.101] CloseHandle (hObject=0x1a0) returned 1 [0205.101] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.102] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.102] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0205.102] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.102] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0205.102] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk")) returned 1 [0205.103] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01 - command prompt.lnk")) returned 0xffffffff [0205.103] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.103] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.104] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.105] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x467 [0205.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.105] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0205.111] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0205.124] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x467, lpOverlapped=0x0) returned 1 [0205.125] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x470, lpOverlapped=0x0) returned 1 [0205.126] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.141] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.145] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.152] CloseHandle (hObject=0x1a0) returned 1 [0205.152] CloseHandle (hObject=0x19c) returned 1 [0205.152] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.153] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.153] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0205.153] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.153] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0205.153] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk")) returned 1 [0205.154] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\01a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\01a - windows powershell.lnk")) returned 0xffffffff [0205.154] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.154] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.154] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.155] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x423 [0205.155] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.155] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0205.163] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0205.175] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x423, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x423, lpOverlapped=0x0) returned 1 [0205.493] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x430, lpOverlapped=0x0) returned 1 [0205.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.509] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.512] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.519] CloseHandle (hObject=0x19c) returned 1 [0205.519] CloseHandle (hObject=0x1a0) returned 1 [0205.519] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.520] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.520] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0205.520] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.520] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0205.520] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk")) returned 1 [0205.521] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02 - Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02 - command prompt.lnk")) returned 0xffffffff [0205.521] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.521] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.522] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.522] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x493 [0205.522] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.523] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0205.530] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0205.542] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x493, lpOverlapped=0x0) returned 1 [0205.643] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x4a0, lpOverlapped=0x0) returned 1 [0205.644] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.660] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.664] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.670] CloseHandle (hObject=0x1a0) returned 1 [0205.671] CloseHandle (hObject=0x19c) returned 1 [0205.671] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.671] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.672] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0205.672] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.672] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0205.672] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk")) returned 1 [0205.673] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\02a - Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\02a - windows powershell.lnk")) returned 0xffffffff [0205.673] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.673] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.674] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.674] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0205.674] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.674] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0205.681] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0205.693] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3f7, lpOverlapped=0x0) returned 1 [0205.843] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0205.843] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.858] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.862] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.869] CloseHandle (hObject=0x19c) returned 1 [0205.869] CloseHandle (hObject=0x1a0) returned 1 [0205.869] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.870] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.870] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0205.870] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.870] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0205.871] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk")) returned 1 [0205.871] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\03 - Computer Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\03 - computer management.lnk")) returned 0xffffffff [0205.871] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.872] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.872] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.873] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0205.873] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.874] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0205.881] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0205.893] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3f7, lpOverlapped=0x0) returned 1 [0205.962] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0205.963] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0205.978] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0205.982] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.989] CloseHandle (hObject=0x1a0) returned 1 [0205.989] CloseHandle (hObject=0x19c) returned 1 [0205.989] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0205.990] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0205.990] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0205.990] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0205.990] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0205.990] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk")) returned 1 [0205.991] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04 - Disk Management.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04 - disk management.lnk")) returned 0xffffffff [0205.991] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0205.992] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0205.992] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0205.992] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x449 [0205.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0205.993] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0206.000] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0206.012] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x449, lpOverlapped=0x0) returned 1 [0206.060] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x450, lpOverlapped=0x0) returned 1 [0206.061] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0206.079] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0206.083] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.091] CloseHandle (hObject=0x19c) returned 1 [0206.091] CloseHandle (hObject=0x1a0) returned 1 [0206.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0206.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0206.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0206.092] FindNextFileA (in: hFindFile=0x535240, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0206.092] FindClose (in: hFindFile=0x535240 | out: hFindFile=0x535240) returned 1 [0206.092] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk")) returned 1 [0206.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\04-1 - Network Connections.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\04-1 - network connections.lnk")) returned 0xffffffff [0206.093] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0206.094] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0206.094] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0206.095] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x433 [0206.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0206.095] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0206.104] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0206.119] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x433, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x433, lpOverlapped=0x0) returned 1 [0206.146] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x440, lpOverlapped=0x0) returned 1 [0206.147] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0206.167] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0206.172] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.179] CloseHandle (hObject=0x1a0) returned 1 [0206.179] CloseHandle (hObject=0x19c) returned 1 [0206.179] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0206.180] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0206.180] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0206.180] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0206.180] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0206.180] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk")) returned 1 [0206.181] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\05 - Device Manager.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\05 - device manager.lnk")) returned 0xffffffff [0206.181] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0206.181] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0206.181] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0206.182] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x425 [0206.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0206.183] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0206.190] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0206.202] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x425, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x425, lpOverlapped=0x0) returned 1 [0206.229] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x430, lpOverlapped=0x0) returned 1 [0206.230] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0206.247] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0206.251] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.258] CloseHandle (hObject=0x19c) returned 1 [0206.258] CloseHandle (hObject=0x1a0) returned 1 [0206.259] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0206.260] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0206.260] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0206.260] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0206.260] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0206.260] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk")) returned 1 [0206.265] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\06 - System.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\06 - system.lnk")) returned 0xffffffff [0206.265] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0206.266] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0206.267] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0206.267] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0206.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0206.268] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0206.274] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0206.287] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3f7, lpOverlapped=0x0) returned 1 [0207.346] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0207.347] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.363] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.366] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.373] CloseHandle (hObject=0x1a0) returned 1 [0207.373] CloseHandle (hObject=0x19c) returned 1 [0207.373] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0207.374] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0207.374] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0207.374] FindNextFileA (in: hFindFile=0x535200, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0207.374] FindClose (in: hFindFile=0x535200 | out: hFindFile=0x535200) returned 1 [0207.374] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk")) returned 1 [0207.375] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\07 - Event Viewer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\07 - event viewer.lnk")) returned 0xffffffff [0207.375] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0207.376] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0207.376] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0207.376] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x431 [0207.376] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0207.377] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0207.383] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0207.396] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x431, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x431, lpOverlapped=0x0) returned 1 [0207.434] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x440, lpOverlapped=0x0) returned 1 [0207.435] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.451] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.461] CloseHandle (hObject=0x19c) returned 1 [0207.461] CloseHandle (hObject=0x1a0) returned 1 [0207.461] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0207.462] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0207.462] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0207.462] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0207.462] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0207.462] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk")) returned 1 [0207.463] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\08 - Power Options.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\08 - power options.lnk")) returned 0xffffffff [0207.463] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0207.463] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0207.463] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0207.464] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3f7 [0207.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0207.464] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0207.471] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0207.483] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3f7, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3f7, lpOverlapped=0x0) returned 1 [0207.536] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x400, lpOverlapped=0x0) returned 1 [0207.537] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.552] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.562] CloseHandle (hObject=0x1a0) returned 1 [0207.562] CloseHandle (hObject=0x19c) returned 1 [0207.562] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0207.564] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0207.564] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0207.564] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0207.564] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0207.564] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk")) returned 1 [0207.565] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\09 - Mobility Center.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\09 - mobility center.lnk")) returned 0xffffffff [0207.565] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0207.565] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0207.565] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0207.566] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43f [0207.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0207.566] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0207.573] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0207.586] ReadFile (in: hFile=0x19c, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x43f, lpOverlapped=0x0) returned 1 [0207.687] WriteFile (in: hFile=0x1a0, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x440, lpOverlapped=0x0) returned 1 [0207.687] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.704] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.708] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.716] CloseHandle (hObject=0x19c) returned 1 [0207.716] CloseHandle (hObject=0x1a0) returned 1 [0207.716] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0207.717] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0207.717] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0207.717] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0207.717] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0207.717] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk")) returned 1 [0207.718] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\10 - Programs and Features.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\10 - programs and features.lnk")) returned 0xffffffff [0207.718] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0207.718] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1a0 [0207.719] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0207.719] GetFileSize (in: hFile=0x1a0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3bb [0207.719] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0207.720] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0207.728] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0207.743] ReadFile (in: hFile=0x1a0, lpBuffer=0x1d47008, nNumberOfBytesToRead=0x3bb, lpNumberOfBytesRead=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesRead=0x19ea44*=0x3bb, lpOverlapped=0x0) returned 1 [0207.813] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x19ea44, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ea44*=0x3c0, lpOverlapped=0x0) returned 1 [0207.814] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.829] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.833] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.840] CloseHandle (hObject=0x1a0) returned 1 [0207.840] CloseHandle (hObject=0x19c) returned 1 [0207.840] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0207.841] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0207.841] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f00 [0207.842] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0 [0207.842] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0207.842] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini")) returned 1 [0207.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\winx\\group3\\desktop.ini")) returned 0xffffffff [0207.843] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0 [0207.843] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0207.843] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0207.843] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0207.843] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0207.843] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0207.843] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0207.843] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Live\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535300 [0207.843] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.843] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.843] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535040 [0207.843] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0207.844] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0207.844] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0207.844] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0207.844] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0207.844] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0207.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534e40 [0207.844] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.844] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535000 [0207.844] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0207.844] FindNextFileA (in: hFindFile=0x535000, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0207.844] FindClose (in: hFindFile=0x535000 | out: hFindFile=0x535000) returned 1 [0207.844] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.844] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0207.844] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x190 [0207.845] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0207.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0207.845] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0207.852] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0207.864] ReadFile (in: hFile=0x188, lpBuffer=0x1d47010, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesRead=0x19ef14*=0x50, lpOverlapped=0x0) returned 1 [0207.865] WriteFile (in: hFile=0x190, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x19ef14, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ef14*=0x60, lpOverlapped=0x0) returned 1 [0207.866] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.881] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.885] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.892] CloseHandle (hObject=0x188) returned 1 [0207.892] CloseHandle (hObject=0x190) returned 1 [0207.892] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0207.893] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0207.893] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535380 [0207.893] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0 [0207.893] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0207.893] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0207.894] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows Sidebar\\settings.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0207.894] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0207.894] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0207.894] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0207.894] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0207.894] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0207.894] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x534f00 [0207.894] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0207.894] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0207.894] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0207.895] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.895] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0207.895] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5351c0 [0207.895] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0207.895] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0207.895] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0207.896] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0207.957] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0207.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0207.958] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0207.965] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0207.976] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0207.977] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0207.992] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0207.997] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.004] CloseHandle (hObject=0x188) returned 1 [0208.004] CloseHandle (hObject=0x19c) returned 1 [0208.004] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0208.005] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0208.005] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0208.005] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0208.005] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0208.005] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat")) returned 1 [0208.005] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_bingpagedata\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_bingpagedata\\container.dat")) returned 0xffffffff [0208.006] FindNextFileA (in: hFindFile=0x5351c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0208.006] FindClose (in: hFindFile=0x5351c0 | out: hFindFile=0x5351c0) returned 1 [0208.006] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.006] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x5353c0 [0208.006] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.006] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.006] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0208.006] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0208.123] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0208.123] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0208.123] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0208.130] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0208.143] WriteFile (in: hFile=0x188, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0208.144] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0208.159] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0208.163] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.170] CloseHandle (hObject=0x19c) returned 1 [0208.170] CloseHandle (hObject=0x188) returned 1 [0208.170] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0208.171] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0208.171] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0208.171] FindNextFileA (in: hFindFile=0x535040, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0208.171] FindClose (in: hFindFile=0x535040 | out: hFindFile=0x535040) returned 1 [0208.171] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat")) returned 1 [0208.172] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_dntexception\\container.dat")) returned 0xffffffff [0208.172] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0208.172] FindClose (in: hFindFile=0x5353c0 | out: hFindFile=0x5353c0) returned 1 [0208.172] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.172] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535380 [0208.172] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.172] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.172] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0208.172] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0208.174] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0208.174] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0208.174] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0208.181] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0208.193] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0208.193] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0208.208] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0208.212] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.226] CloseHandle (hObject=0x188) returned 1 [0208.226] CloseHandle (hObject=0x19c) returned 1 [0208.227] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0208.227] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0208.227] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0208.228] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0208.228] FindClose (in: hFindFile=0x534e40 | out: hFindFile=0x534e40) returned 1 [0208.228] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat")) returned 1 [0208.228] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompat\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompat\\container.dat")) returned 0xffffffff [0208.228] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.228] FindNextFileA (in: hFindFile=0x535380, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0208.228] FindClose (in: hFindFile=0x535380 | out: hFindFile=0x535380) returned 1 [0208.229] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.229] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e80 [0208.229] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.229] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.229] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0208.229] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0208.232] GetFileSize (in: hFile=0x19c, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0208.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0208.232] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0208.239] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0208.251] WriteFile (in: hFile=0x188, lpBuffer=0x1d47008*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47008*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0208.252] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0208.268] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0208.271] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.278] CloseHandle (hObject=0x19c) returned 1 [0208.278] CloseHandle (hObject=0x188) returned 1 [0208.278] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0208.279] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0208.279] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0208.279] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0208.279] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0208.279] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat")) returned 1 [0208.280] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_iecompatua\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_iecompatua\\container.dat")) returned 0xffffffff [0208.280] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0208.280] FindClose (in: hFindFile=0x534e80 | out: hFindFile=0x534e80) returned 1 [0208.280] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.280] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x535400 [0208.280] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.280] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.280] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x188 [0208.280] CreateFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x19c [0208.282] GetFileSize (in: hFile=0x188, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0208.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0208.282] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0208.289] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0208.301] WriteFile (in: hFile=0x19c, lpBuffer=0x1d47010*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19ecac, lpOverlapped=0x0 | out: lpBuffer=0x1d47010*, lpNumberOfBytesWritten=0x19ecac*=0x10, lpOverlapped=0x0) returned 1 [0208.302] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0208.318] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0208.322] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.329] CloseHandle (hObject=0x188) returned 1 [0208.329] CloseHandle (hObject=0x19c) returned 1 [0208.329] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0208.330] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0208.330] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0208.330] FindNextFileA (in: hFindFile=0x535300, lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0 [0208.330] FindClose (in: hFindFile=0x535300 | out: hFindFile=0x535300) returned 1 [0208.330] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat")) returned 1 [0208.331] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\MicrosoftEdge_ieflipahead\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoftedge\\sharedcachecontainers\\microsoftedge_ieflipahead\\container.dat")) returned 0xffffffff [0208.331] FindNextFileA (in: hFindFile=0x535400, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0208.331] FindClose (in: hFindFile=0x535400 | out: hFindFile=0x535400) returned 1 [0208.331] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0208.331] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0208.331] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0208.331] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\User\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x535180 [0208.332] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.332] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.332] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\MicrosoftEdge\\User\\Default\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534c80 [0208.332] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.332] FindNextFileA (in: hFindFile=0x534c80, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0 [0208.332] FindClose (in: hFindFile=0x534c80 | out: hFindFile=0x534c80) returned 1 [0208.332] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0 [0208.332] FindClose (in: hFindFile=0x535180 | out: hFindFile=0x535180) returned 1 [0208.332] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0 [0208.332] FindClose (in: hFindFile=0x534f00 | out: hFindFile=0x534f00) returned 1 [0208.332] FindNextFileA (in: hFindFile=0x534dc0, lpFindFileData=0x19f66c | out: lpFindFileData=0x19f66c) returned 1 [0208.332] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\*.*", lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 0x535180 [0208.332] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0208.332] FindNextFileA (in: hFindFile=0x535180, lpFindFileData=0x19f404 | out: lpFindFileData=0x19f404) returned 1 [0208.332] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\*.*", lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 0x534f00 [0208.333] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.333] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.333] FindNextFileA (in: hFindFile=0x534f00, lpFindFileData=0x19f19c | out: lpFindFileData=0x19f19c) returned 1 [0208.333] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*.*", lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 0x534e40 [0208.334] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.334] FindNextFileA (in: hFindFile=0x534e40, lpFindFileData=0x19ef34 | out: lpFindFileData=0x19ef34) returned 1 [0208.334] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\*.*", lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 0x5353c0 [0208.457] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0208.457] FindNextFileA (in: hFindFile=0x5353c0, lpFindFileData=0x19eccc | out: lpFindFileData=0x19eccc) returned 1 [0208.457] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\*.*", lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 0x534e80 [0208.609] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0208.609] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0208.609] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\doomed\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534ec0 [0208.609] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0208.610] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0 [0208.610] FindClose (in: hFindFile=0x534ec0 | out: hFindFile=0x534ec0) returned 1 [0208.610] FindNextFileA (in: hFindFile=0x534e80, lpFindFileData=0x19ea64 | out: lpFindFileData=0x19ea64) returned 1 [0208.610] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\entries\\*.*", lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 0x534ec0 [0208.872] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.140] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.141] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.141] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.142] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.142] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.143] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.143] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.144] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.145] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.145] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.146] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.146] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.147] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.147] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.148] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.148] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.149] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.149] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.150] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.150] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.151] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.151] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.152] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.314] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.315] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.316] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.316] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.317] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.318] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.318] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.319] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.320] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.320] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.321] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.322] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.322] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.323] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.324] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.324] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.325] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.326] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.327] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.327] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.328] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.329] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.330] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.500] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.501] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.502] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.503] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.503] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.504] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.505] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.506] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.506] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.507] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.508] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.509] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.509] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.510] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.511] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.511] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.512] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.513] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.514] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.514] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.515] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.516] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.517] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.587] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.588] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.589] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.590] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.590] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.591] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.592] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.593] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.593] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.594] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.595] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.596] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.597] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.597] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.598] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.599] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.599] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.600] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.601] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.602] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.602] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.603] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.604] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.607] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.608] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.609] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.609] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.610] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.611] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.612] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.612] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.613] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.614] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.615] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.615] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.616] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.617] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.618] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.618] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.619] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.620] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.620] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.621] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.622] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.623] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.623] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.628] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.628] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.629] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.630] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.631] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.631] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.632] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.633] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.634] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.634] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.635] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.636] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.637] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.637] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.638] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.639] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.639] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.640] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.641] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.642] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.643] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.643] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.644] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.645] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.646] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.647] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.648] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.648] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.649] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.650] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.651] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.651] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.652] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.653] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.653] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.654] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.655] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.656] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.656] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.657] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.658] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.659] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.660] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.660] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.661] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.662] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.666] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.667] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.668] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.668] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.669] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.670] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.671] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.671] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.672] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.673] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.674] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.674] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.675] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.676] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.677] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.677] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.678] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.679] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.679] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.680] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.681] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.682] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.682] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.687] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.688] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.689] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.689] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.690] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.691] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.692] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.692] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.693] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.694] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.695] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.695] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.696] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.697] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.698] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.698] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.699] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.700] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.701] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.701] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.702] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.703] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.703] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.706] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.707] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.708] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.709] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.709] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.710] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.711] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.712] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.712] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.713] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.714] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.715] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.715] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.716] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.717] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.717] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.718] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.719] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.720] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.721] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.721] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.722] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.723] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.727] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.728] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.729] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.729] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.730] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.731] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.732] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.732] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.733] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.734] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.735] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.735] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.736] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.737] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.738] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.738] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.739] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.740] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.741] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.741] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.742] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.743] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.743] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.748] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.749] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.749] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.750] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.751] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.752] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.753] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.753] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.754] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.755] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.756] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.756] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.757] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.758] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.759] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.759] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.760] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.761] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.762] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.762] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.763] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.764] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.765] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.767] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.768] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.769] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.769] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.770] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.771] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.772] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.772] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.773] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.774] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.775] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.775] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.776] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.777] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.778] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.778] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.779] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.780] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0209.781] FindNextFileA (in: hFindFile=0x534ec0, lpFindFileData=0x19e7fc | out: lpFindFileData=0x19e7fc) returned 1 [0210.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.024] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.031] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.062] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.077] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.083] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.089] CloseHandle (hObject=0x1a0) returned 1 [0210.089] CloseHandle (hObject=0x1a4) returned 1 [0210.090] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.090] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\cache2\\index.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.090] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\cache2\\index.log", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534c80 [0210.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.093] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.108] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.127] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.144] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.154] CloseHandle (hObject=0x188) returned 1 [0210.155] CloseHandle (hObject=0x1a4) returned 1 [0210.155] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.156] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\directorylinks.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\directoryLinks.json", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0210.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.158] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.165] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.178] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.194] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.198] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.205] CloseHandle (hObject=0x1a4) returned 1 [0210.205] CloseHandle (hObject=0x188) returned 1 [0210.205] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\frequencyCap.json" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\frequencycap.json"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\frequencyCap.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\frequencycap.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.206] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\frequencyCap.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\frequencycap.json.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.206] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\frequencyCap.json", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0210.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.224] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.231] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.259] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.275] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.279] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.291] CloseHandle (hObject=0x1a4) returned 1 [0210.291] CloseHandle (hObject=0x1a0) returned 1 [0210.291] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\4mkHR_p+Wn_2AEZoGYTTQQ==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\4mkhr_p+wn_2aezogyttqq==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\4mkHR_p+Wn_2AEZoGYTTQQ==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\4mkhr_p+wn_2aezogyttqq==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.292] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\4mkHR_p+Wn_2AEZoGYTTQQ==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\4mkhr_p+wn_2aezogyttqq==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.292] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\4mkHR_p+Wn_2AEZoGYTTQQ==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5351c0 [0210.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.293] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.300] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.445] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.465] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.469] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.476] CloseHandle (hObject=0x1a0) returned 1 [0210.477] CloseHandle (hObject=0x1a4) returned 1 [0210.477] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\asRZLAIfRhwB7KZygffeFA==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\asrzlaifrhwb7kzygffefa==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\asRZLAIfRhwB7KZygffeFA==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\asrzlaifrhwb7kzygffefa==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.478] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\asRZLAIfRhwB7KZygffeFA==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\asrzlaifrhwb7kzygffefa==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\asRZLAIfRhwB7KZygffeFA==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535000 [0210.479] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.479] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.487] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.517] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.521] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.528] CloseHandle (hObject=0x1a4) returned 1 [0210.528] CloseHandle (hObject=0x1a0) returned 1 [0210.529] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.530] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\d+wy3cvuncc3wva6du1bzg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.530] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\d+wy3CvuNcC3WVA6du1bZg==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535400 [0210.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.531] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.539] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.553] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.568] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.572] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.579] CloseHandle (hObject=0x1a0) returned 1 [0210.579] CloseHandle (hObject=0x1a4) returned 1 [0210.579] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\DiktK+QHhLcJqWKZ9_VsTA==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\diktk+qhhlcjqwkz9_vsta==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\DiktK+QHhLcJqWKZ9_VsTA==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\diktk+qhhlcjqwkz9_vsta==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.580] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\DiktK+QHhLcJqWKZ9_VsTA==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\diktk+qhhlcjqwkz9_vsta==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.580] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\DiktK+QHhLcJqWKZ9_VsTA==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e80 [0210.582] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.582] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.589] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.617] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.635] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.645] CloseHandle (hObject=0x1a4) returned 1 [0210.645] CloseHandle (hObject=0x1a0) returned 1 [0210.646] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\dLcXOMhmEiiUNPBG1nL8Ew==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\dlcxomhmeiiunpbg1nl8ew==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\dLcXOMhmEiiUNPBG1nL8Ew==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\dlcxomhmeiiunpbg1nl8ew==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\dLcXOMhmEiiUNPBG1nL8Ew==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\dlcxomhmeiiunpbg1nl8ew==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\dLcXOMhmEiiUNPBG1nL8Ew==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535400 [0210.649] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.649] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.656] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.699] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.703] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.709] CloseHandle (hObject=0x1a0) returned 1 [0210.709] CloseHandle (hObject=0x1a4) returned 1 [0210.710] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\GNtk5OH7OPlVUCH7Ue1nuw==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\gntk5oh7oplvuch7ue1nuw==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\GNtk5OH7OPlVUCH7Ue1nuw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\gntk5oh7oplvuch7ue1nuw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.711] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\GNtk5OH7OPlVUCH7Ue1nuw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\gntk5oh7oplvuch7ue1nuw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.711] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\GNtk5OH7OPlVUCH7Ue1nuw==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e80 [0210.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.712] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.719] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.734] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.749] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.760] CloseHandle (hObject=0x1a4) returned 1 [0210.760] CloseHandle (hObject=0x1a0) returned 1 [0210.760] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\iNtr8V5+A8pq96nV92I9rg==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\intr8v5+a8pq96nv92i9rg==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\iNtr8V5+A8pq96nV92I9rg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\intr8v5+a8pq96nv92i9rg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.761] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\iNtr8V5+A8pq96nV92I9rg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\intr8v5+a8pq96nv92i9rg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.761] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\iNtr8V5+A8pq96nV92I9rg==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534d00 [0210.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.763] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.770] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.796] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.817] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.828] CloseHandle (hObject=0x1a0) returned 1 [0210.828] CloseHandle (hObject=0x1a4) returned 1 [0210.828] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KMkld2mykTtwKDykdZ4gNA==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kmkld2mykttwkdykdz4gna==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KMkld2mykTtwKDykdZ4gNA==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kmkld2mykttwkdykdz4gna==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.829] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KMkld2mykTtwKDykdZ4gNA==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kmkld2mykttwkdykdz4gna==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.829] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KMkld2mykTtwKDykdZ4gNA==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535400 [0210.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.831] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.838] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.864] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.880] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.884] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.891] CloseHandle (hObject=0x1a4) returned 1 [0210.891] CloseHandle (hObject=0x1a0) returned 1 [0210.891] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KykeNQT8cz0GP+hqz5mIpw==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kykenqt8cz0gp+hqz5mipw==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KykeNQT8cz0GP+hqz5mIpw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kykenqt8cz0gp+hqz5mipw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.892] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KykeNQT8cz0GP+hqz5mIpw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kykenqt8cz0gp+hqz5mipw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.892] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\KykeNQT8cz0GP+hqz5mIpw==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535000 [0210.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.894] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.901] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0210.955] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0210.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.966] CloseHandle (hObject=0x1a0) returned 1 [0210.966] CloseHandle (hObject=0x1a4) returned 1 [0210.966] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\kZbAJfgDibZzMvDTka320Q==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kzbajfgdibzzmvdtka320q==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\kZbAJfgDibZzMvDTka320Q==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kzbajfgdibzzmvdtka320q==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0210.967] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\kZbAJfgDibZzMvDTka320Q==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\kzbajfgdibzzmvdtka320q==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0210.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\kZbAJfgDibZzMvDTka320Q==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0210.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0210.969] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0210.975] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0210.991] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.006] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.010] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.017] CloseHandle (hObject=0x1a4) returned 1 [0211.017] CloseHandle (hObject=0x1a0) returned 1 [0211.017] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\K_jbA2CUeAAOJVMrlKk+gQ==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\k_jba2cueaaojvmrlkk+gq==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\K_jbA2CUeAAOJVMrlKk+gQ==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\k_jba2cueaaojvmrlkk+gq==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.018] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\K_jbA2CUeAAOJVMrlKk+gQ==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\k_jba2cueaaojvmrlkk+gq==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.018] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\K_jbA2CUeAAOJVMrlKk+gQ==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e80 [0211.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.020] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.027] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.057] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.072] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.076] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.083] CloseHandle (hObject=0x1a0) returned 1 [0211.083] CloseHandle (hObject=0x1a4) returned 1 [0211.083] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\mgDer72BXyCa3ilaVifttQ==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\mgder72bxyca3ilavifttq==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\mgDer72BXyCa3ilaVifttQ==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\mgder72bxyca3ilavifttq==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.084] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\mgDer72BXyCa3ilaVifttQ==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\mgder72bxyca3ilavifttq==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.084] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\mgDer72BXyCa3ilaVifttQ==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535000 [0211.086] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.086] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.093] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.107] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.123] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.127] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.134] CloseHandle (hObject=0x1a4) returned 1 [0211.134] CloseHandle (hObject=0x1a0) returned 1 [0211.134] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\obXqSkYxtPxKEzhnvwJwjg==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\obxqskyxtpxkezhnvwjwjg==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\obXqSkYxtPxKEzhnvwJwjg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\obxqskyxtpxkezhnvwjwjg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.135] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\obXqSkYxtPxKEzhnvwJwjg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\obxqskyxtpxkezhnvwjwjg==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.135] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\obXqSkYxtPxKEzhnvwJwjg==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535380 [0211.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.136] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.144] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.158] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.174] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.179] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.186] CloseHandle (hObject=0x1a0) returned 1 [0211.186] CloseHandle (hObject=0x1a4) returned 1 [0211.186] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\ttwZSCROfkViyTVqAFLXrw==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\ttwzscrofkviytvqaflxrw==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\ttwZSCROfkViyTVqAFLXrw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\ttwzscrofkviytvqaflxrw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.187] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\ttwZSCROfkViyTVqAFLXrw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\ttwzscrofkviytvqaflxrw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.187] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\ttwZSCROfkViyTVqAFLXrw==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5351c0 [0211.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.189] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.195] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.245] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.249] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.255] CloseHandle (hObject=0x1a4) returned 1 [0211.255] CloseHandle (hObject=0x1a0) returned 1 [0211.256] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\XUMtyI1WhW2H+uz6m0iFOw==.ico" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\xumtyi1whw2h+uz6m0ifow==.ico"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\XUMtyI1WhW2H+uz6m0iFOw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\xumtyi1whw2h+uz6m0ifow==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.256] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\XUMtyI1WhW2H+uz6m0iFOw==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\jumplistcache\\xumtyi1whw2h+uz6m0ifow==.ico.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.257] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\jumpListCache\\XUMtyI1WhW2H+uz6m0iFOw==.ico", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535380 [0211.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.297] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.303] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.348] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.351] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.358] CloseHandle (hObject=0x1a0) returned 1 [0211.358] CloseHandle (hObject=0x1a4) returned 1 [0211.358] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.359] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.359] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\0e292d2be40784b709a96299f7f56c4c.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535300 [0211.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.362] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.369] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.385] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.400] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.404] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.411] CloseHandle (hObject=0x1a4) returned 1 [0211.411] CloseHandle (hObject=0x1a0) returned 1 [0211.411] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.412] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.412] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\28c9257769b2913b70283ca4759e2034.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535300 [0211.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.414] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.421] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.603] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.619] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.623] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.629] CloseHandle (hObject=0x1a0) returned 1 [0211.630] CloseHandle (hObject=0x1a4) returned 1 [0211.630] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.631] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.631] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\2bf8db03609478000e25532b94a93e81.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0211.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.633] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.640] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.656] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.671] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.675] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.682] CloseHandle (hObject=0x1a4) returned 1 [0211.682] CloseHandle (hObject=0x1a0) returned 1 [0211.682] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.683] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.683] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\5d432dc88d56856d87faecfa9b48853b.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535400 [0211.684] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.685] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.691] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.736] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.740] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.747] CloseHandle (hObject=0x1a0) returned 1 [0211.747] CloseHandle (hObject=0x1a4) returned 1 [0211.747] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.748] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\77ec32dc2bee35c0b759503a76ed5b66.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0211.751] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.751] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.758] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.781] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.797] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.801] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.815] CloseHandle (hObject=0x1a4) returned 1 [0211.815] CloseHandle (hObject=0x1a0) returned 1 [0211.815] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.816] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.816] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\b6dc1948244e7e4562c9356a0052d7af.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535080 [0211.818] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.818] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.825] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.850] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.865] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.869] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.876] CloseHandle (hObject=0x1a0) returned 1 [0211.876] CloseHandle (hObject=0x1a4) returned 1 [0211.876] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.877] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\mozilla\\firefox\\profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.877] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\thumbnails\\e214427ea25af5774381fe2c2582382e.png", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0211.927] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.927] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0211.935] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0211.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0211.976] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0211.980] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.987] CloseHandle (hObject=0x188) returned 1 [0211.987] CloseHandle (hObject=0x1a4) returned 1 [0211.988] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0211.989] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\microsoft.3dbuilder_10.0.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0211.989] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Microsoft.3DBuilder_10.0.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0211.993] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0211.993] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.000] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.042] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.045] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.052] CloseHandle (hObject=0x19c) returned 1 [0212.052] CloseHandle (hObject=0x1a4) returned 1 [0212.052] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.053] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.3dbuilder_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.053] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.3DBuilder_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0212.070] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.070] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.077] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.091] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.107] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.111] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.118] CloseHandle (hObject=0x19c) returned 1 [0212.118] CloseHandle (hObject=0x188) returned 1 [0212.118] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.119] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\microsoft.aad.brokerplugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.119] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Microsoft.AAD.BrokerPlugin_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535240 [0212.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.127] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.134] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.149] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.164] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.169] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.176] CloseHandle (hObject=0x1a4) returned 1 [0212.176] CloseHandle (hObject=0x188) returned 1 [0212.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.aad.brokerplugin_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.177] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534cc0 [0212.200] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.201] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.207] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.225] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.256] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.260] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.267] CloseHandle (hObject=0x1a4) returned 1 [0212.267] CloseHandle (hObject=0x19c) returned 1 [0212.267] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.268] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\microsoft.accountscontrol_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.268] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Microsoft.AccountsControl_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0212.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.278] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.285] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.299] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.315] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.318] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.325] CloseHandle (hObject=0x188) returned 1 [0212.325] CloseHandle (hObject=0x19c) returned 1 [0212.325] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.326] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.326] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0212.499] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.499] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.506] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.616] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.632] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.636] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.643] CloseHandle (hObject=0x188) returned 1 [0212.643] CloseHandle (hObject=0x1a4) returned 1 [0212.643] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.644] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\microsoft.appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.644] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535080 [0212.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.648] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.654] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.687] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.703] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.706] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.713] CloseHandle (hObject=0x19c) returned 1 [0212.713] CloseHandle (hObject=0x1a4) returned 1 [0212.713] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.714] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.appconnector_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.714] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Appconnector_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0212.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.747] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.757] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.785] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.815] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.830] CloseHandle (hObject=0x19c) returned 1 [0212.830] CloseHandle (hObject=0x188) returned 1 [0212.830] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.831] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\microsoft.bingfinance_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.831] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Microsoft.BingFinance_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0212.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0212.837] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0212.846] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0212.865] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0212.887] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0212.892] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.901] CloseHandle (hObject=0x1a4) returned 1 [0212.901] CloseHandle (hObject=0x188) returned 1 [0212.901] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0212.903] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingfinance_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0212.903] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingFinance_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0213.053] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.053] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.064] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.106] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.112] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.122] CloseHandle (hObject=0x1a4) returned 1 [0213.122] CloseHandle (hObject=0x19c) returned 1 [0213.122] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.124] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\microsoft.bingnews_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.124] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Microsoft.BingNews_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0213.127] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.128] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.176] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.198] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.209] CloseHandle (hObject=0x188) returned 1 [0213.209] CloseHandle (hObject=0x19c) returned 1 [0213.210] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingnews_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.211] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0213.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.250] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.258] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.288] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.314] CloseHandle (hObject=0x188) returned 1 [0213.314] CloseHandle (hObject=0x1a4) returned 1 [0213.314] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.315] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\microsoft.bingsports_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.315] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Microsoft.BingSports_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0213.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.319] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.327] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.341] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.356] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.360] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.367] CloseHandle (hObject=0x19c) returned 1 [0213.367] CloseHandle (hObject=0x1a4) returned 1 [0213.367] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.368] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingsports_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.368] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingSports_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0213.410] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.411] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.418] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.433] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.448] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.452] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.459] CloseHandle (hObject=0x19c) returned 1 [0213.459] CloseHandle (hObject=0x188) returned 1 [0213.460] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.461] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\microsoft.bingweather_4.3.193.0_x86__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.461] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Microsoft.BingWeather_4.3.193.0_x86__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0213.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.464] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.471] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.485] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.501] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.504] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.511] CloseHandle (hObject=0x1a4) returned 1 [0213.511] CloseHandle (hObject=0x188) returned 1 [0213.511] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.512] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bingweather_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.512] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BingWeather_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534cc0 [0213.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.534] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.541] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.590] CloseHandle (hObject=0x1a4) returned 1 [0213.590] CloseHandle (hObject=0x19c) returned 1 [0213.590] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.591] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\microsoft.bioenrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.591] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Microsoft.BioEnrollment_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0213.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.605] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.613] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.658] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.662] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.675] CloseHandle (hObject=0x188) returned 1 [0213.675] CloseHandle (hObject=0x19c) returned 1 [0213.675] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.676] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.bioenrollment_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.676] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.BioEnrollment_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0213.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.712] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.719] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.734] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.760] CloseHandle (hObject=0x188) returned 1 [0213.760] CloseHandle (hObject=0x1a4) returned 1 [0213.760] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.762] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\microsoft.getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.762] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Microsoft.Getstarted_2.1.9.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0213.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.765] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.771] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.786] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.801] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.811] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.818] CloseHandle (hObject=0x19c) returned 1 [0213.818] CloseHandle (hObject=0x1a4) returned 1 [0213.818] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.819] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.getstarted_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.819] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0213.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.825] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.832] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.847] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.864] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.868] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.875] CloseHandle (hObject=0x19c) returned 1 [0213.875] CloseHandle (hObject=0x188) returned 1 [0213.875] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.876] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\microsoft.lockapp_10.0.10240.16384_neutral__cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.876] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Microsoft.LockApp_10.0.10240.16384_neutral__cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0213.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.892] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0213.898] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0213.926] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0213.942] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0213.946] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.952] CloseHandle (hObject=0x1a4) returned 1 [0213.953] CloseHandle (hObject=0x188) returned 1 [0213.953] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0213.954] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.lockapp_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0213.954] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.LockApp_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0213.998] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0213.998] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.005] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.018] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.033] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.045] CloseHandle (hObject=0x1a0) returned 1 [0214.045] CloseHandle (hObject=0x198) returned 1 [0214.045] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.046] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.046] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0214.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.048] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.056] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.074] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.096] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.102] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.110] CloseHandle (hObject=0x198) returned 1 [0214.110] CloseHandle (hObject=0x1a0) returned 1 [0214.110] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.111] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\1zja02jo.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.111] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\1ZJA02JO.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0214.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.114] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.120] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.150] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.155] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.162] CloseHandle (hObject=0x1a0) returned 1 [0214.162] CloseHandle (hObject=0x198) returned 1 [0214.163] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.164] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\268tpjia.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.164] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\268TPJIA.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535000 [0214.166] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.166] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.173] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.187] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.204] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.215] CloseHandle (hObject=0x198) returned 1 [0214.215] CloseHandle (hObject=0x1a0) returned 1 [0214.215] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.217] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\6kwa3r8c.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.217] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\6KWA3R8C.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0214.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.219] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.235] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.252] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.284] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.291] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.302] CloseHandle (hObject=0x1a0) returned 1 [0214.302] CloseHandle (hObject=0x198) returned 1 [0214.302] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.303] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\85dgk2j5.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.303] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\85DGK2J5.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535000 [0214.307] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.307] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.315] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.348] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.352] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.359] CloseHandle (hObject=0x198) returned 1 [0214.359] CloseHandle (hObject=0x1a0) returned 1 [0214.359] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.361] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.361] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0214.363] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.363] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.370] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.385] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.401] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.404] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.411] CloseHandle (hObject=0x1a0) returned 1 [0214.411] CloseHandle (hObject=0x198) returned 1 [0214.412] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.413] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\fpndv7t3.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.413] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\FPNDV7T3.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0214.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.416] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.422] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.436] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.452] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.455] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.462] CloseHandle (hObject=0x198) returned 1 [0214.462] CloseHandle (hObject=0x1a0) returned 1 [0214.462] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.463] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\j9kflzdx.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.463] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\J9KFLZDX.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0214.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.466] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.472] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.487] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.505] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.517] CloseHandle (hObject=0x1a0) returned 1 [0214.517] CloseHandle (hObject=0x198) returned 1 [0214.517] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.518] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\jn00akv9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.518] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\JN00AKV9.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0214.521] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.521] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.528] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.542] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.556] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.560] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.568] CloseHandle (hObject=0x198) returned 1 [0214.568] CloseHandle (hObject=0x1a0) returned 1 [0214.568] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.569] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\or8k8vrm.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.569] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\OR8K8VRM.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0214.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.571] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.578] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.607] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.611] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.619] CloseHandle (hObject=0x1a0) returned 1 [0214.619] CloseHandle (hObject=0x198) returned 1 [0214.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\tk0lxhbl.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\TK0LXHBL.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0214.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.623] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.632] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.647] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.663] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.666] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.673] CloseHandle (hObject=0x198) returned 1 [0214.673] CloseHandle (hObject=0x1a0) returned 1 [0214.673] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.674] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vc62gjsf.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.674] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VC62GJSF.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0214.676] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.676] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.683] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.697] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.713] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.717] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.724] CloseHandle (hObject=0x1a0) returned 1 [0214.724] CloseHandle (hObject=0x198) returned 1 [0214.724] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.725] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\vsmdvd55.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.725] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\VSMDVD55.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0214.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.726] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.733] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.746] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.761] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.765] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.772] CloseHandle (hObject=0x198) returned 1 [0214.772] CloseHandle (hObject=0x1a0) returned 1 [0214.772] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.773] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\history\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.773] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\History\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0214.774] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.775] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.781] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.794] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.822] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.826] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.833] CloseHandle (hObject=0x1a0) returned 1 [0214.833] CloseHandle (hObject=0x198) returned 1 [0214.834] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.835] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.835] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatCache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534f40 [0214.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.836] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.843] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.856] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.871] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.875] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.881] CloseHandle (hObject=0x198) returned 1 [0214.882] CloseHandle (hObject=0x1a0) returned 1 [0214.882] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.883] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.883] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IECompatUaCache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534c80 [0214.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.885] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.892] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.905] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.920] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.924] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.931] CloseHandle (hObject=0x1a0) returned 1 [0214.932] CloseHandle (hObject=0x198) returned 1 [0214.932] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.933] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.933] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0214.933] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.934] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0214.940] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0214.965] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0214.981] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0214.985] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.992] CloseHandle (hObject=0x19c) returned 1 [0214.992] CloseHandle (hObject=0x198) returned 1 [0214.992] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0214.993] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0214.993] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\MSIMGSIZ.DAT", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0214.995] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0214.996] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.002] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.031] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.035] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.043] CloseHandle (hObject=0x1ac) returned 1 [0215.043] CloseHandle (hObject=0x1b0) returned 1 [0215.043] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.044] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.044] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534c80 [0215.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.046] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.052] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.065] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.081] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.085] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.091] CloseHandle (hObject=0x1ac) returned 1 [0215.092] CloseHandle (hObject=0x1a8) returned 1 [0215.092] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\Y2EKXLK8\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\y2ekxlk8\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\Y2EKXLK8\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\y2ekxlk8\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\Y2EKXLK8\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\user\\default\\appcache\\y2ekxlk8\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.093] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\User\\Default\\AppCache\\Y2EKXLK8\\container.dat", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x5353c0 [0215.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.195] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.203] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.242] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.246] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.253] CloseHandle (hObject=0x19c) returned 1 [0215.253] CloseHandle (hObject=0x1a0) returned 1 [0215.254] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.255] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.255] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535240 [0215.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.257] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.263] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.278] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.296] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.300] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.308] CloseHandle (hObject=0x1a0) returned 1 [0215.308] CloseHandle (hObject=0x19c) returned 1 [0215.308] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.309] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\51tu1403.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.309] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\51TU1403.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535080 [0215.312] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.312] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.319] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.332] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.350] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.354] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.361] CloseHandle (hObject=0x19c) returned 1 [0215.361] CloseHandle (hObject=0x1a0) returned 1 [0215.361] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.362] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\5gjkp08h.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.362] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\5GJKP08H.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534f40 [0215.364] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.364] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.372] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.386] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.401] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.405] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.412] CloseHandle (hObject=0x1a0) returned 1 [0215.412] CloseHandle (hObject=0x19c) returned 1 [0215.412] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.413] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\6nq9v8cd.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.413] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\6NQ9V8CD.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534f40 [0215.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.415] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.422] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.441] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.464] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.469] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.478] CloseHandle (hObject=0x19c) returned 1 [0215.478] CloseHandle (hObject=0x1a0) returned 1 [0215.478] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.479] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.480] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0215.481] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.481] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.488] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.502] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.517] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.521] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.528] CloseHandle (hObject=0x1a0) returned 1 [0215.528] CloseHandle (hObject=0x19c) returned 1 [0215.528] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.529] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\jz1uuup9.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.529] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\JZ1UUUP9.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535200 [0215.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.531] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.537] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.551] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.566] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.569] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.576] CloseHandle (hObject=0x19c) returned 1 [0215.576] CloseHandle (hObject=0x1a0) returned 1 [0215.576] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.577] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\kw0ulafv.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.577] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\KW0ULAFV.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0215.579] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.579] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.586] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.603] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.622] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.627] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.635] CloseHandle (hObject=0x1a0) returned 1 [0215.635] CloseHandle (hObject=0x19c) returned 1 [0215.635] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.636] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\sw6z4ai1.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.636] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\SW6Z4AI1.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0215.637] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.638] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.645] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.661] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.681] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.686] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.695] CloseHandle (hObject=0x19c) returned 1 [0215.695] CloseHandle (hObject=0x1a0) returned 1 [0215.695] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.697] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\tu6xbkfe.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.697] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\TU6XBKFE.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535400 [0215.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.699] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.705] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.720] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.735] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.738] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.745] CloseHandle (hObject=0x1a0) returned 1 [0215.745] CloseHandle (hObject=0x19c) returned 1 [0215.747] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.747] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies\\u9pt9v3q.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.748] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\U9PT9V3Q.txt", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535240 [0215.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.749] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.756] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.769] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.784] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.788] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.795] CloseHandle (hObject=0x19c) returned 1 [0215.795] CloseHandle (hObject=0x1a0) returned 1 [0215.795] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.796] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\history\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.796] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\History\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0215.797] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.797] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.804] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.824] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.839] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.843] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.850] CloseHandle (hObject=0x1a0) returned 1 [0215.850] CloseHandle (hObject=0x19c) returned 1 [0215.850] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.851] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.851] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatCache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535200 [0215.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.852] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.859] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.873] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.889] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.892] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.899] CloseHandle (hObject=0x19c) returned 1 [0215.899] CloseHandle (hObject=0x1a0) returned 1 [0215.899] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.900] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.900] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\IECompatUaCache\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534f40 [0215.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.902] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.908] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.932] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0215.954] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0215.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.965] CloseHandle (hObject=0x198) returned 1 [0215.965] CloseHandle (hObject=0x1a0) returned 1 [0215.965] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0215.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\msimgsiz.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0215.966] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\MSIMGSIZ.DAT", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535400 [0215.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0215.968] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0215.975] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0215.989] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.006] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.013] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.020] CloseHandle (hObject=0x1b0) returned 1 [0216.020] CloseHandle (hObject=0x1a8) returned 1 [0216.020] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.021] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.021] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\container.dat", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535180 [0216.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.041] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.048] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.073] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.092] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.095] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.103] CloseHandle (hObject=0x1ac) returned 1 [0216.103] CloseHandle (hObject=0x1b4) returned 1 [0216.103] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.104] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1ab36a6a[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.105] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1ab36a6a[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535300 [0216.106] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.106] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.113] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.165] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.169] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.176] CloseHandle (hObject=0x1b4) returned 1 [0216.176] CloseHandle (hObject=0x1ac) returned 1 [0216.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\1acd62c3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.177] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\1acd62c3[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535400 [0216.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.179] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.186] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.219] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.222] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.237] CloseHandle (hObject=0x1ac) returned 1 [0216.237] CloseHandle (hObject=0x1b4) returned 1 [0216.237] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.238] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\236a1503[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.238] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\236a1503[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x534f40 [0216.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.240] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.246] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.280] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.295] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.299] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.305] CloseHandle (hObject=0x1b4) returned 1 [0216.305] CloseHandle (hObject=0x1ac) returned 1 [0216.306] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.307] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\36a8ead3[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.307] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\36a8ead3[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535300 [0216.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.310] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.316] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.347] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.363] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.367] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.374] CloseHandle (hObject=0x1ac) returned 1 [0216.374] CloseHandle (hObject=0x1b4) returned 1 [0216.374] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.376] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\3727cd16[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.376] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\3727cd16[1].css", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535300 [0216.377] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.378] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.387] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.489] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.505] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.509] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.516] CloseHandle (hObject=0x1b4) returned 1 [0216.516] CloseHandle (hObject=0x1ac) returned 1 [0216.516] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.517] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\41795194[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.517] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\41795194[1].css", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535400 [0216.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.519] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.527] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.603] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.619] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.623] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.630] CloseHandle (hObject=0x1ac) returned 1 [0216.630] CloseHandle (hObject=0x1b4) returned 1 [0216.630] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.631] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\9101d3f2[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.631] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\9101d3f2[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535400 [0216.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.655] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.662] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.693] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.698] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.705] CloseHandle (hObject=0x1b4) returned 1 [0216.705] CloseHandle (hObject=0x1ac) returned 1 [0216.705] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.706] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.706] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\container.dat", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535000 [0216.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.707] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.715] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.790] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.811] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.815] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.822] CloseHandle (hObject=0x1ac) returned 1 [0216.822] CloseHandle (hObject=0x1b4) returned 1 [0216.822] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.823] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\d11fd6a0[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.823] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\d11fd6a0[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535300 [0216.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.825] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.832] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.872] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.887] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.891] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.898] CloseHandle (hObject=0x1b4) returned 1 [0216.898] CloseHandle (hObject=0x1ac) returned 1 [0216.898] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.899] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f544a93b[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.899] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f544a93b[1].css", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535300 [0216.901] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.901] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.908] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0216.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0216.956] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0216.960] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.967] CloseHandle (hObject=0x1ac) returned 1 [0216.967] CloseHandle (hObject=0x1b4) returned 1 [0216.968] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0216.969] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\f682f456[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0216.969] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\f682f456[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535400 [0216.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0216.972] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0216.979] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.012] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.028] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.032] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.039] CloseHandle (hObject=0x1b4) returned 1 [0217.039] CloseHandle (hObject=0x1ac) returned 1 [0217.039] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.041] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\fce27fce[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.041] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\fce27fce[1].js", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x535300 [0217.042] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.043] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.049] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.068] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.083] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.087] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.094] CloseHandle (hObject=0x1ac) returned 1 [0217.094] CloseHandle (hObject=0x1b4) returned 1 [0217.095] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.095] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\1\\init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.096] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\1\\Init[1].htm", lpFindFileData=0x19dad0 | out: lpFindFileData=0x19dad0) returned 0x534f40 [0217.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.098] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.106] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.122] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.138] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.142] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.148] CloseHandle (hObject=0x1b0) returned 1 [0217.148] CloseHandle (hObject=0x1b4) returned 1 [0217.148] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.150] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\appcache\\e6zy23ko\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.150] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\AppCache\\E6ZY23KO\\container.dat", lpFindFileData=0x19dd38 | out: lpFindFileData=0x19dd38) returned 0x535300 [0217.153] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.153] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.160] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.176] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.191] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.196] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.203] CloseHandle (hObject=0x1a8) returned 1 [0217.203] CloseHandle (hObject=0x1b4) returned 1 [0217.203] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.204] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\user\\default\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.204] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\User\\Default\\DOMStore\\container.dat", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x534c80 [0217.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.244] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.251] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.266] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.282] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.286] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.293] CloseHandle (hObject=0x1a0) returned 1 [0217.293] CloseHandle (hObject=0x198) returned 1 [0217.293] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.294] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\bingpagedatacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.294] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\BingPageDataCache\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5351c0 [0217.295] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.295] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.302] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.318] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.333] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.337] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.344] CloseHandle (hObject=0x198) returned 1 [0217.344] CloseHandle (hObject=0x1a0) returned 1 [0217.344] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.345] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.345] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cache\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535080 [0217.347] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.347] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.355] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.388] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.398] CloseHandle (hObject=0x1a0) returned 1 [0217.398] CloseHandle (hObject=0x198) returned 1 [0217.399] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.400] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1143sfpt.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.400] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1143SFPT.txt", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0217.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.402] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.409] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.426] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.443] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.447] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.454] CloseHandle (hObject=0x198) returned 1 [0217.454] CloseHandle (hObject=0x1a0) returned 1 [0217.454] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.455] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\1hp9xsya.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.455] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\1HP9XSYA.txt", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534d00 [0217.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.458] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.464] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.482] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.498] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.508] CloseHandle (hObject=0x1a0) returned 1 [0217.508] CloseHandle (hObject=0x198) returned 1 [0217.508] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.509] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\205espv2.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.509] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\205ESPV2.txt", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535400 [0217.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.511] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.518] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.535] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.551] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.555] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.561] CloseHandle (hObject=0x198) returned 1 [0217.561] CloseHandle (hObject=0x1a0) returned 1 [0217.562] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.562] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.563] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0217.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.564] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.571] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.589] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.605] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.608] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.615] CloseHandle (hObject=0x1a0) returned 1 [0217.615] CloseHandle (hObject=0x198) returned 1 [0217.615] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.616] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies\\y51ocfz0.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.616] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\Y51OCFZ0.txt", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0217.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.618] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.625] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.702] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.717] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.721] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.728] CloseHandle (hObject=0x198) returned 1 [0217.728] CloseHandle (hObject=0x1a0) returned 1 [0217.728] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.729] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cortanaassist\\allowlist.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.729] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\CortanaAssist\\AllowList.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535200 [0217.733] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.733] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.740] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.760] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.775] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.779] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.786] CloseHandle (hObject=0x1a0) returned 1 [0217.786] CloseHandle (hObject=0x198) returned 1 [0217.786] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.787] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\history\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.787] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\History\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0217.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.788] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.795] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.820] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.835] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.839] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.846] CloseHandle (hObject=0x198) returned 1 [0217.846] CloseHandle (hObject=0x1a0) returned 1 [0217.847] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.848] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.848] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatCache\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535300 [0217.849] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.849] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.856] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.875] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.890] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.901] CloseHandle (hObject=0x1a0) returned 1 [0217.901] CloseHandle (hObject=0x198) returned 1 [0217.901] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.902] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\iecompatuacache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.902] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IECompatUaCache\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534d00 [0217.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.903] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.910] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0217.929] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0217.944] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0217.949] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.955] CloseHandle (hObject=0x198) returned 1 [0217.955] CloseHandle (hObject=0x1a0) returned 1 [0217.956] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0217.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\ieflipaheadcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0217.957] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\IEFlipAheadCache\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0217.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0217.962] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0217.969] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0218.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0218.114] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0218.118] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.125] CloseHandle (hObject=0x1ac) returned 1 [0218.125] CloseHandle (hObject=0x1b8) returned 1 [0218.125] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\edb.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\edb.chk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0218.126] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0218.126] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\edb.chk", lpFindFileData=0x19d868 | out: lpFindFileData=0x19d868) returned 0x535400 [0218.349] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0218.349] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0218.357] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0218.449] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0218.467] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0218.471] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.478] CloseHandle (hObject=0x1ac) returned 1 [0218.479] CloseHandle (hObject=0x1bc) returned 1 [0218.479] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0218.480] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0218.480] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edb.log", lpFindFileData=0x19d600 | out: lpFindFileData=0x19d600) returned 0x534ec0 [0218.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0218.485] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0218.492] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0218.549] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0218.564] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0218.568] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.576] CloseHandle (hObject=0x1bc) returned 1 [0218.576] CloseHandle (hObject=0x1ac) returned 1 [0218.576] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0218.577] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\datastore\\data\\nouser1\\120712-0049\\dbstore\\logfiles\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0218.577] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DataStore\\Data\\nouser1\\120712-0049\\DBStore\\LogFiles\\edbtmp.log", lpFindFileData=0x19d600 | out: lpFindFileData=0x19d600) returned 0x535400 [0218.585] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0218.585] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0218.593] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0218.632] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0218.650] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0218.654] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.661] CloseHandle (hObject=0x19c) returned 1 [0218.661] CloseHandle (hObject=0x1b4) returned 1 [0218.661] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DNTException\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\dntexception\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0218.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DNTException\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\dntexception\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0218.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DNTException\\container.dat", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534f40 [0218.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0218.663] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0218.671] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0218.729] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0218.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0218.755] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.764] CloseHandle (hObject=0x1b4) returned 1 [0218.764] CloseHandle (hObject=0x19c) returned 1 [0218.764] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\downloadhistory\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\downloadhistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0218.765] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\downloadhistory\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0218.765] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\DownloadHistory\\container.dat", lpFindFileData=0x19e208 | out: lpFindFileData=0x19e208) returned 0x534f40 [0218.814] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0218.815] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0218.821] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0218.919] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0218.934] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0218.938] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.944] CloseHandle (hObject=0x1b4) returned 1 [0218.944] CloseHandle (hObject=0x1a8) returned 1 [0218.945] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0218.946] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\recoverystore.{3d88d67f-6818-11e7-9bd3-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0218.946] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\RecoveryStore.{3D88D67F-6818-11E7-9BD3-C40142ECDE47}.dat", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535200 [0218.947] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0218.948] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0218.954] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.030] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.034] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.041] CloseHandle (hObject=0x1a8) returned 1 [0219.041] CloseHandle (hObject=0x1b4) returned 1 [0219.042] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.042] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\user\\default\\recovery\\active\\{3d88d681-6818-11e7-9bd3-c40142ecde47}.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0219.042] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\User\\Default\\Recovery\\Active\\{3D88D681-6818-11E7-9BD3-C40142ECDE47}.dat", lpFindFileData=0x19dfa0 | out: lpFindFileData=0x19dfa0) returned 0x535080 [0219.068] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0219.068] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0219.075] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.128] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.143] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.147] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.153] CloseHandle (hObject=0x198) returned 1 [0219.153] CloseHandle (hObject=0x19c) returned 1 [0219.154] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.chk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.155] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0219.155] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.chk", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0219.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0219.156] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0219.163] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.285] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.310] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.315] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.392] CloseHandle (hObject=0x19c) returned 1 [0219.392] CloseHandle (hObject=0x198) returned 1 [0219.392] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.393] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0219.393] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edb.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0219.401] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0219.401] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0219.411] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.525] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.529] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.536] CloseHandle (hObject=0x198) returned 1 [0219.536] CloseHandle (hObject=0x19c) returned 1 [0219.536] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.537] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\appdata\\user\\default\\indexed db\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0219.537] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AppData\\User\\Default\\Indexed DB\\edbtmp.log", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535000 [0219.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0219.555] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0219.562] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.622] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.638] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.642] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.649] CloseHandle (hObject=0x1a4) returned 1 [0219.649] CloseHandle (hObject=0x1a0) returned 1 [0219.649] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.650] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\microsoft.microsoftedge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0219.650] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Microsoft.MicrosoftEdge_20.10240.16384.0_neutral__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0219.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0219.690] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0219.697] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.779] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.800] CloseHandle (hObject=0x188) returned 1 [0219.800] CloseHandle (hObject=0x1a0) returned 1 [0219.801] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.802] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0219.802] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0219.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0219.856] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0219.866] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0219.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0219.955] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0219.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.966] CloseHandle (hObject=0x188) returned 1 [0219.967] CloseHandle (hObject=0x1a4) returned 1 [0219.967] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0219.968] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\microsoft.microsoftofficehub_17.4218.23751.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0219.968] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Microsoft.MicrosoftOfficeHub_17.4218.23751.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0220.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0220.042] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0220.052] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0220.275] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0220.306] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0220.313] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.323] CloseHandle (hObject=0x1a0) returned 1 [0220.323] CloseHandle (hObject=0x1a4) returned 1 [0220.323] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0220.324] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftofficehub_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0220.324] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0220.552] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0220.552] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0220.562] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0220.625] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0220.646] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0220.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.660] CloseHandle (hObject=0x1a0) returned 1 [0220.660] CloseHandle (hObject=0x188) returned 1 [0220.660] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0220.661] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\microsoft.microsoftsolitairecollection_3.1.6103.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0220.661] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Microsoft.MicrosoftSolitaireCollection_3.1.6103.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0220.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0220.666] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0220.676] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0220.737] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0220.759] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0220.764] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.773] CloseHandle (hObject=0x1a4) returned 1 [0220.773] CloseHandle (hObject=0x188) returned 1 [0220.774] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0220.775] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.microsoftsolitairecollection_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0220.775] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0220.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0220.831] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0220.840] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0220.892] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0220.911] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0220.915] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.924] CloseHandle (hObject=0x188) returned 1 [0220.924] CloseHandle (hObject=0x1a4) returned 1 [0220.924] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0220.925] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.framework.1.0_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0220.925] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0220.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0220.971] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0220.979] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.032] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.052] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.056] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.065] CloseHandle (hObject=0x1a4) returned 1 [0221.065] CloseHandle (hObject=0x188) returned 1 [0221.065] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.066] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.net.native.runtime.1.0_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.066] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.0_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0221.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.093] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.101] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.219] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.223] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.230] CloseHandle (hObject=0x1a4) returned 1 [0221.230] CloseHandle (hObject=0x1a0) returned 1 [0221.230] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.231] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\microsoft.office.onenote_17.4201.10091.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.231] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Microsoft.Office.OneNote_17.4201.10091.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535200 [0221.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.267] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.276] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.329] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.348] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.353] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.361] CloseHandle (hObject=0x188) returned 1 [0221.361] CloseHandle (hObject=0x1a0) returned 1 [0221.361] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.362] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.office.onenote_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.362] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Office.OneNote_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0221.392] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.392] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.400] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.457] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.475] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.478] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.486] CloseHandle (hObject=0x188) returned 1 [0221.486] CloseHandle (hObject=0x1a4) returned 1 [0221.487] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.488] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\microsoft.people_1.10159.0.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.488] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Microsoft.People_1.10159.0.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0221.491] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.492] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.500] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.619] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.635] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.638] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.645] CloseHandle (hObject=0x1a0) returned 1 [0221.645] CloseHandle (hObject=0x1a4) returned 1 [0221.646] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.people_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.647] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.People_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0221.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.730] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.737] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.782] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.797] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.801] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.808] CloseHandle (hObject=0x1a0) returned 1 [0221.808] CloseHandle (hObject=0x188) returned 1 [0221.808] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.809] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.809] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0221.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.820] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.827] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0221.901] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0221.923] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0221.928] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.938] CloseHandle (hObject=0x1a4) returned 1 [0221.938] CloseHandle (hObject=0x188) returned 1 [0221.938] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0221.939] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.skypeapp_kzf8qxf38zg5c\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0221.939] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.SkypeApp_kzf8qxf38zg5c\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0221.971] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0221.971] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0221.980] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.033] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.048] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.052] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.058] CloseHandle (hObject=0x188) returned 1 [0222.059] CloseHandle (hObject=0x1a4) returned 1 [0222.059] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.060] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.vclibs.140.00_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0222.060] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0222.097] CloseHandle (hObject=0x188) returned 1 [0222.097] CloseHandle (hObject=0xffffffff) returned 1 [0222.098] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.098] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0222.098] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0222.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.114] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.121] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.166] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.181] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.184] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.191] CloseHandle (hObject=0x1a4) returned 1 [0222.191] CloseHandle (hObject=0x188) returned 1 [0222.192] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.193] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0222.193] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0222.195] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.196] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.202] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.308] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.313] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.319] CloseHandle (hObject=0x1a0) returned 1 [0222.319] CloseHandle (hObject=0x19c) returned 1 [0222.319] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\7CSZDG21\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\7cszdg21\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\7CSZDG21\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\7cszdg21\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.320] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\7CSZDG21\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\7cszdg21\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.321] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\7CSZDG21\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0222.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.322] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.329] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.389] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.393] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.399] CloseHandle (hObject=0x1a4) returned 1 [0222.400] CloseHandle (hObject=0x19c) returned 1 [0222.400] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.401] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.401] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\AppCache\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0222.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.402] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.410] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.470] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.480] CloseHandle (hObject=0x19c) returned 1 [0222.480] CloseHandle (hObject=0x1a4) returned 1 [0222.480] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.481] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.481] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0222.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.483] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.490] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.533] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.554] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.559] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.566] CloseHandle (hObject=0x1a4) returned 1 [0222.566] CloseHandle (hObject=0x19c) returned 1 [0222.566] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.567] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.567] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535380 [0222.607] CloseHandle (hObject=0x19c) returned 1 [0222.607] CloseHandle (hObject=0xffffffff) returned 1 [0222.607] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.608] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\microsoft.windows.cloudexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0222.608] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0222.615] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.616] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.623] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.676] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.692] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.696] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.707] CloseHandle (hObject=0x188) returned 1 [0222.707] CloseHandle (hObject=0x19c) returned 1 [0222.707] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.708] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0222.708] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534cc0 [0222.712] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.712] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.719] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.764] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.779] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.783] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.791] CloseHandle (hObject=0x188) returned 1 [0222.791] CloseHandle (hObject=0x1a4) returned 1 [0222.791] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.793] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.793] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCache\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0222.794] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.794] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.804] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.865] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.880] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.884] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.891] CloseHandle (hObject=0x1a4) returned 1 [0222.891] CloseHandle (hObject=0x188) returned 1 [0222.892] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.892] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.893] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0222.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0222.894] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0222.901] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0222.945] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0222.961] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0222.965] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.972] CloseHandle (hObject=0x1a4) returned 1 [0222.972] CloseHandle (hObject=0x1a0) returned 1 [0222.972] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0222.973] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0222.973] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0223.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.150] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.157] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.203] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.220] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.223] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.230] CloseHandle (hObject=0x1a4) returned 1 [0223.230] CloseHandle (hObject=0x198) returned 1 [0223.230] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.232] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.232] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0223.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.251] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.258] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.307] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.323] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.326] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.334] CloseHandle (hObject=0x198) returned 1 [0223.334] CloseHandle (hObject=0x1a4) returned 1 [0223.334] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.335] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209562\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.335] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209562\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0223.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.337] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.344] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.387] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.403] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.413] CloseHandle (hObject=0x1a4) returned 1 [0223.414] CloseHandle (hObject=0x198) returned 1 [0223.414] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.415] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.415] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534c80 [0223.416] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.417] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.425] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.469] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.484] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.488] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.495] CloseHandle (hObject=0x198) returned 1 [0223.495] CloseHandle (hObject=0x1a4) returned 1 [0223.495] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.496] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209776\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.496] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209776\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0223.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.499] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.505] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.549] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.565] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.569] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.575] CloseHandle (hObject=0x1a4) returned 1 [0223.576] CloseHandle (hObject=0x198) returned 1 [0223.576] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.577] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.577] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534d00 [0223.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.578] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.585] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.629] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.645] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.649] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.656] CloseHandle (hObject=0x198) returned 1 [0223.656] CloseHandle (hObject=0x1a4) returned 1 [0223.656] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.657] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209809\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.657] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209809\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0223.660] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.661] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.668] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.713] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.729] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.739] CloseHandle (hObject=0x1a4) returned 1 [0223.739] CloseHandle (hObject=0x198) returned 1 [0223.740] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.741] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.741] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534cc0 [0223.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.742] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.748] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.793] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.808] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.818] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.824] CloseHandle (hObject=0x198) returned 1 [0223.824] CloseHandle (hObject=0x1a4) returned 1 [0223.825] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.825] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\209857\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.826] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\209857\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534cc0 [0223.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.828] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.835] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.879] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.894] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.898] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.905] CloseHandle (hObject=0x1a4) returned 1 [0223.905] CloseHandle (hObject=0x198) returned 1 [0223.905] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.906] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.907] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535200 [0223.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0223.908] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0223.916] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0223.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0223.975] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0223.979] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.988] CloseHandle (hObject=0x198) returned 1 [0223.988] CloseHandle (hObject=0x1a4) returned 1 [0223.988] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0223.989] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210469\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0223.989] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210469\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535400 [0224.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.001] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.009] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.052] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.068] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.071] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.079] CloseHandle (hObject=0x1a4) returned 1 [0224.079] CloseHandle (hObject=0x198) returned 1 [0224.079] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.080] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0224.080] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535400 [0224.081] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.082] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.088] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.133] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.149] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.152] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.159] CloseHandle (hObject=0x198) returned 1 [0224.159] CloseHandle (hObject=0x1a4) returned 1 [0224.160] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.161] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\210509\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0224.161] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\210509\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534d00 [0224.163] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.163] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.170] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.228] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.239] CloseHandle (hObject=0x1a4) returned 1 [0224.239] CloseHandle (hObject=0x198) returned 1 [0224.239] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.240] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\eventbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0224.240] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\eventbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0224.241] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.241] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.248] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.439] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.462] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.473] CloseHandle (hObject=0x198) returned 1 [0224.474] CloseHandle (hObject=0x1a4) returned 1 [0224.474] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.475] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\localstate\\contentmanagementsdk\\creatives\\214513\\imprbeacons.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0224.475] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\ContentManagementSDK\\Creatives\\214513\\imprbeacons.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534e40 [0224.475] CloseHandle (hObject=0x188) returned 1 [0224.475] CloseHandle (hObject=0xffffffff) returned 1 [0224.476] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.476] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\microsoft.windows.contentdeliverymanager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0224.476] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Microsoft.Windows.ContentDeliveryManager_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0224.478] CloseHandle (hObject=0xffffffff) returned 1 [0224.478] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.478] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0224.478] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0224.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.480] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.487] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.530] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.545] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.549] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.556] CloseHandle (hObject=0x188) returned 1 [0224.556] CloseHandle (hObject=0x1a0) returned 1 [0224.556] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.557] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0224.557] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0224.568] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.568] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.575] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.618] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.634] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.637] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.644] CloseHandle (hObject=0x1a4) returned 1 [0224.645] CloseHandle (hObject=0x198) returned 1 [0224.645] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.646] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0224.646] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0224.647] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.647] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.654] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.715] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.730] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.735] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.742] CloseHandle (hObject=0x198) returned 1 [0224.742] CloseHandle (hObject=0x1a4) returned 1 [0224.742] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.743] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\12\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0224.743] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\12\\zinc[1].htm", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0224.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.745] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.752] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.797] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.819] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.823] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.830] CloseHandle (hObject=0x1a4) returned 1 [0224.830] CloseHandle (hObject=0x198) returned 1 [0224.831] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\045d3532[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\045d3532[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\045d3532[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\045d3532[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.832] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\045d3532[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\045d3532[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0224.832] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\045d3532[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0224.833] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.833] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.840] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.886] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.901] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.905] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.912] CloseHandle (hObject=0x198) returned 1 [0224.912] CloseHandle (hObject=0x1a4) returned 1 [0224.913] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\0c3a2f0b[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\0c3a2f0b[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\0c3a2f0b[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\0c3a2f0b[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.914] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\0c3a2f0b[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\0c3a2f0b[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0224.914] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\0c3a2f0b[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0224.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.915] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0224.924] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0224.968] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0224.984] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0224.988] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.995] CloseHandle (hObject=0x1a4) returned 1 [0224.995] CloseHandle (hObject=0x198) returned 1 [0224.995] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\11ee0799[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\11ee0799[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\11ee0799[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\11ee0799[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0224.996] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\11ee0799[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\11ee0799[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0224.996] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\11ee0799[1].css", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0224.998] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0224.998] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.005] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.050] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.066] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.069] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.076] CloseHandle (hObject=0x198) returned 1 [0225.076] CloseHandle (hObject=0x1a4) returned 1 [0225.076] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2462f13c[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2462f13c[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2462f13c[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2462f13c[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.078] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2462f13c[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2462f13c[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.078] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2462f13c[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0225.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.080] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.088] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.149] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.153] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.161] CloseHandle (hObject=0x1a4) returned 1 [0225.161] CloseHandle (hObject=0x198) returned 1 [0225.161] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2743db28[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2743db28[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2743db28[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2743db28[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.162] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2743db28[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2743db28[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.162] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2743db28[1].css", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0225.164] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.164] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.171] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.233] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.237] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.244] CloseHandle (hObject=0x198) returned 1 [0225.244] CloseHandle (hObject=0x1a4) returned 1 [0225.244] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2d27e2b0[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2d27e2b0[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2d27e2b0[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2d27e2b0[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.245] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2d27e2b0[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\2d27e2b0[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.245] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\2d27e2b0[1].css", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0225.247] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.247] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.343] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.390] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.405] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.409] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.417] CloseHandle (hObject=0x1a4) returned 1 [0225.417] CloseHandle (hObject=0x198) returned 1 [0225.417] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\3417f6c5[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\3417f6c5[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\3417f6c5[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\3417f6c5[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.418] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\3417f6c5[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\3417f6c5[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.418] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\3417f6c5[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0225.419] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.419] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.426] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.472] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.496] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.506] CloseHandle (hObject=0x198) returned 1 [0225.506] CloseHandle (hObject=0x1a4) returned 1 [0225.506] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\359d2aee[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\359d2aee[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\359d2aee[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\359d2aee[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.507] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\359d2aee[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\359d2aee[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.507] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\359d2aee[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535380 [0225.510] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.510] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.520] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.569] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.586] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.590] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.597] CloseHandle (hObject=0x1a4) returned 1 [0225.597] CloseHandle (hObject=0x198) returned 1 [0225.597] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\424a9e57[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\424a9e57[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\424a9e57[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\424a9e57[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.598] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\424a9e57[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\424a9e57[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.598] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\424a9e57[1].css", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535200 [0225.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.600] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.607] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.654] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.669] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.674] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.680] CloseHandle (hObject=0x198) returned 1 [0225.680] CloseHandle (hObject=0x1a4) returned 1 [0225.681] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\48a99eae[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\48a99eae[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\48a99eae[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\48a99eae[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.682] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\48a99eae[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\48a99eae[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.682] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\48a99eae[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0225.684] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.684] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.691] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.738] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.753] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.757] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.765] CloseHandle (hObject=0x1a4) returned 1 [0225.765] CloseHandle (hObject=0x198) returned 1 [0225.765] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\5bf5eed4[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\5bf5eed4[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\5bf5eed4[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\5bf5eed4[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.768] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\5bf5eed4[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\5bf5eed4[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.768] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\5bf5eed4[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534c80 [0225.769] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.770] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.776] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.831] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.846] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.850] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.857] CloseHandle (hObject=0x198) returned 1 [0225.857] CloseHandle (hObject=0x1a4) returned 1 [0225.857] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\8636b4dd[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\8636b4dd[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\8636b4dd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\8636b4dd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.858] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\8636b4dd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\8636b4dd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.858] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\8636b4dd[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0225.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.861] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.868] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0225.931] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0225.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.941] CloseHandle (hObject=0x1a4) returned 1 [0225.942] CloseHandle (hObject=0x198) returned 1 [0225.942] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\89c17add[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\89c17add[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\89c17add[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\89c17add[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0225.943] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\89c17add[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\89c17add[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0225.943] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\89c17add[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0225.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0225.945] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0225.952] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0225.997] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.012] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.017] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.023] CloseHandle (hObject=0x198) returned 1 [0226.024] CloseHandle (hObject=0x1a4) returned 1 [0226.024] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\961fe1d8[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\961fe1d8[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\961fe1d8[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\961fe1d8[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.025] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\961fe1d8[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\961fe1d8[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.025] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\961fe1d8[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0226.027] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.027] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.034] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.101] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.104] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.112] CloseHandle (hObject=0x1a4) returned 1 [0226.112] CloseHandle (hObject=0x198) returned 1 [0226.112] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\ab584def[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\ab584def[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\ab584def[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\ab584def[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.113] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\ab584def[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\ab584def[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.113] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\ab584def[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0226.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.116] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.123] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.228] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.244] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.247] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.314] CloseHandle (hObject=0x198) returned 1 [0226.315] CloseHandle (hObject=0x1a4) returned 1 [0226.315] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\b7511cfd[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\b7511cfd[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\b7511cfd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\b7511cfd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.316] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\b7511cfd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\b7511cfd[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.316] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\b7511cfd[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535180 [0226.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.321] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.328] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.372] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.388] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.399] CloseHandle (hObject=0x1a4) returned 1 [0226.399] CloseHandle (hObject=0x198) returned 1 [0226.399] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.400] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.400] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5351c0 [0226.401] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.401] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.408] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.469] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.472] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.479] CloseHandle (hObject=0x198) returned 1 [0226.479] CloseHandle (hObject=0x1a4) returned 1 [0226.479] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\d78ba3ab[1].css" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\d78ba3ab[1].css"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\d78ba3ab[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\d78ba3ab[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.480] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\d78ba3ab[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\d78ba3ab[1].css.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.480] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\d78ba3ab[1].css", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534cc0 [0226.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.482] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.490] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.541] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.557] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.569] CloseHandle (hObject=0x1a4) returned 1 [0226.569] CloseHandle (hObject=0x198) returned 1 [0226.569] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\dbef2181[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\dbef2181[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\dbef2181[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\dbef2181[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.570] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\dbef2181[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\dbef2181[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.571] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\dbef2181[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x5353c0 [0226.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.573] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.580] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.629] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.645] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.648] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.655] CloseHandle (hObject=0x198) returned 1 [0226.655] CloseHandle (hObject=0x1a4) returned 1 [0226.656] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e1e405d1[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\e1e405d1[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e1e405d1[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\e1e405d1[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.657] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e1e405d1[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\e1e405d1[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.657] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e1e405d1[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0226.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.660] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.667] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.715] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.736] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.741] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.751] CloseHandle (hObject=0x1a4) returned 1 [0226.751] CloseHandle (hObject=0x198) returned 1 [0226.751] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e3f307cb[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\e3f307cb[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e3f307cb[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\e3f307cb[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.752] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e3f307cb[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\e3f307cb[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.752] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\e3f307cb[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0226.755] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.755] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.764] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.830] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.851] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.856] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.866] CloseHandle (hObject=0x198) returned 1 [0226.866] CloseHandle (hObject=0x1a4) returned 1 [0226.866] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\fcd21029[1].js" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\fcd21029[1].js"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\fcd21029[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\fcd21029[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.867] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\fcd21029[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\fcd21029[1].js.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.867] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\fcd21029[1].js", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0226.869] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.870] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.879] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0226.934] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0226.956] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0226.961] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.970] CloseHandle (hObject=0x1a4) returned 1 [0226.970] CloseHandle (hObject=0x198) returned 1 [0226.971] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\Init[1].htm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\init[1].htm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\Init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0226.971] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\Init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\23\\init[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0226.971] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\23\\Init[1].htm", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0226.989] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0226.990] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0226.998] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.043] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.059] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.063] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.070] CloseHandle (hObject=0x198) returned 1 [0227.070] CloseHandle (hObject=0x1a4) returned 1 [0227.070] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.071] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.071] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534ec0 [0227.073] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.073] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.081] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.147] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.168] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.173] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.182] CloseHandle (hObject=0x1a4) returned 1 [0227.182] CloseHandle (hObject=0x198) returned 1 [0227.182] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.183] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\5\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.183] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\5\\zinc[1].htm", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535040 [0227.309] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.310] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.319] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.381] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.402] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.416] CloseHandle (hObject=0x198) returned 1 [0227.416] CloseHandle (hObject=0x1a4) returned 1 [0227.417] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.418] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.418] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x534cc0 [0227.419] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.419] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.428] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.505] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.526] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.531] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.544] CloseHandle (hObject=0x1a4) returned 1 [0227.544] CloseHandle (hObject=0x198) returned 1 [0227.545] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.546] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\6\\zinc[1].htm.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.546] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\6\\zinc[1].htm", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535380 [0227.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.633] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.642] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.720] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.725] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.734] CloseHandle (hObject=0x188) returned 1 [0227.735] CloseHandle (hObject=0x198) returned 1 [0227.735] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.736] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\r1utjct7\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.736] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\R1UTJCT7\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0227.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.738] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.747] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.805] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.835] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.840] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.849] CloseHandle (hObject=0x1a0) returned 1 [0227.849] CloseHandle (hObject=0x198) returned 1 [0227.849] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.850] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.850] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0227.853] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.853] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.863] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0227.921] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0227.942] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0227.947] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.955] CloseHandle (hObject=0x198) returned 1 [0227.955] CloseHandle (hObject=0x1a0) returned 1 [0227.956] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0227.957] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0227.957] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0227.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0227.959] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0227.968] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.021] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.037] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.041] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.049] CloseHandle (hObject=0x1a0) returned 1 [0228.049] CloseHandle (hObject=0x198) returned 1 [0228.050] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.051] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\lvkkmmvn.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0228.051] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\LVKKMMVN.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534ec0 [0228.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.053] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.059] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.105] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.127] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.141] CloseHandle (hObject=0x198) returned 1 [0228.141] CloseHandle (hObject=0x1a0) returned 1 [0228.142] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QCCK4TYM.txt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qcck4tym.txt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QCCK4TYM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qcck4tym.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.143] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QCCK4TYM.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\qcck4tym.txt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0228.143] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\QCCK4TYM.txt", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0228.145] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.145] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.154] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.200] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.216] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.220] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.226] CloseHandle (hObject=0x198) returned 1 [0228.227] CloseHandle (hObject=0x188) returned 1 [0228.227] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.228] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapi\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0228.228] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApi\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534c80 [0228.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.321] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.328] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.388] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.399] CloseHandle (hObject=0x188) returned 1 [0228.399] CloseHandle (hObject=0x198) returned 1 [0228.399] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapigroup\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapigroup\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.400] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\backgroundtransferapigroup\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0228.400] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\BackgroundTransferApiGroup\\container.dat", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0228.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.423] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.430] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.478] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.494] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.498] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.505] CloseHandle (hObject=0x188) returned 1 [0228.505] CloseHandle (hObject=0x1a4) returned 1 [0228.505] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.506] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0228.506] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\DOMStore\\container.dat", lpFindFileData=0x19e470 | out: lpFindFileData=0x19e470) returned 0x535300 [0228.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.509] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.516] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.576] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.580] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.587] CloseHandle (hObject=0x1a0) returned 1 [0228.587] CloseHandle (hObject=0x198) returned 1 [0228.587] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.588] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0228.588] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.chk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0228.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.590] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.597] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.668] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.688] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.702] CloseHandle (hObject=0x198) returned 1 [0228.702] CloseHandle (hObject=0x1a0) returned 1 [0228.703] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.704] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0228.704] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535180 [0228.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.710] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.718] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0228.811] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0228.839] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0228.845] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.853] CloseHandle (hObject=0x1a0) returned 1 [0228.853] CloseHandle (hObject=0x198) returned 1 [0228.853] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0228.854] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00037.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0228.854] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00037.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0228.860] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0228.861] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0228.870] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.009] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.029] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.035] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.044] CloseHandle (hObject=0x198) returned 1 [0229.044] CloseHandle (hObject=0x1a0) returned 1 [0229.044] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.045] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00038.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.045] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00038.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0229.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.051] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.060] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.190] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.211] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.216] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.226] CloseHandle (hObject=0x1a0) returned 1 [0229.226] CloseHandle (hObject=0x198) returned 1 [0229.226] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.227] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb00039.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.227] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb00039.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0229.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.233] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.243] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.391] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.418] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.423] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.432] CloseHandle (hObject=0x198) returned 1 [0229.433] CloseHandle (hObject=0x1a0) returned 1 [0229.433] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.434] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003a.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.434] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003A.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0229.440] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.440] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.449] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.562] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.591] CloseHandle (hObject=0x1a0) returned 1 [0229.591] CloseHandle (hObject=0x198) returned 1 [0229.592] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.594] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003b.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.594] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003B.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0229.602] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.603] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.612] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.699] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.714] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.718] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.725] CloseHandle (hObject=0x198) returned 1 [0229.725] CloseHandle (hObject=0x1a0) returned 1 [0229.725] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.727] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edb0003c.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.727] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edb0003C.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0229.732] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.732] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.739] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.832] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.848] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.851] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.858] CloseHandle (hObject=0x1a0) returned 1 [0229.858] CloseHandle (hObject=0x198) returned 1 [0229.858] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.859] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\appdata\\indexed db\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.859] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AppData\\Indexed DB\\edbtmp.log", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534d00 [0229.864] CloseHandle (hObject=0xffffffff) returned 1 [0229.864] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.864] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\localstate\\speech_onecorereg.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0229.865] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\LocalState\\speech_onecorereg.bin", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0229.866] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.867] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.874] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0229.924] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0229.939] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0229.943] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.950] CloseHandle (hObject=0x198) returned 1 [0229.950] CloseHandle (hObject=0x1a0) returned 1 [0229.950] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.950] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\microsoft.windows.cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0229.950] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Microsoft.Windows.Cortana_1.4.8.152_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0229.952] CloseHandle (hObject=0xffffffff) returned 1 [0229.952] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0229.953] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0229.953] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0229.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0229.985] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0229.992] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.052] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.056] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.062] CloseHandle (hObject=0x1a0) returned 1 [0230.062] CloseHandle (hObject=0x198) returned 1 [0230.062] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.063] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\microsoft.windows.parentalcontrols_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.063] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Microsoft.Windows.ParentalControls_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0230.077] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.077] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.084] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.130] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.146] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.150] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.157] CloseHandle (hObject=0x19c) returned 1 [0230.157] CloseHandle (hObject=0x198) returned 1 [0230.158] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.159] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.parentalcontrols_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.159] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0230.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.193] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.199] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.274] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.337] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.342] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.352] CloseHandle (hObject=0x19c) returned 1 [0230.352] CloseHandle (hObject=0x1a0) returned 1 [0230.352] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.353] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\microsoft.windows.photos_15.618.18170.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.353] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Microsoft.Windows.Photos_15.618.18170.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535180 [0230.374] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.374] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.381] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.462] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.473] CloseHandle (hObject=0x198) returned 1 [0230.473] CloseHandle (hObject=0x1a0) returned 1 [0230.473] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.474] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.photos_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.474] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.Photos_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0230.480] CloseHandle (hObject=0xffffffff) returned 1 [0230.480] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.481] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\microsoft.windows.shellexperiencehost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0230.481] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0230.483] CloseHandle (hObject=0xffffffff) returned 1 [0230.483] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.483] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0230.483] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0230.485] CloseHandle (hObject=0xffffffff) returned 1 [0230.485] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.485] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_data.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0230.485] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Data.bin", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0230.485] CloseHandle (hObject=0xffffffff) returned 1 [0230.485] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.485] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windows.shellexperiencehost_cw5n1h2txyewy\\tempstate\\tilecache_100_0_header.bin.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0230.486] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\TempState\\TileCache_100_0_Header.bin", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0230.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.531] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.540] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.631] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.647] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.658] CloseHandle (hObject=0x198) returned 1 [0230.658] CloseHandle (hObject=0x19c) returned 1 [0230.658] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.659] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\microsoft.windowsalarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.659] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Microsoft.WindowsAlarms_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534cc0 [0230.662] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.662] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.669] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.714] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.729] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.740] CloseHandle (hObject=0x1a0) returned 1 [0230.740] CloseHandle (hObject=0x19c) returned 1 [0230.740] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.741] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsalarms_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.741] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0230.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.781] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.793] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.871] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.886] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.890] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.897] CloseHandle (hObject=0x1a0) returned 1 [0230.897] CloseHandle (hObject=0x198) returned 1 [0230.897] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.898] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\microsoft.windowscalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.898] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Microsoft.WindowsCalculator_10.1506.19010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e80 [0230.904] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0230.904] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0230.911] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0230.956] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0230.972] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0230.977] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.984] CloseHandle (hObject=0x19c) returned 1 [0230.984] CloseHandle (hObject=0x198) returned 1 [0230.985] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0230.985] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscalculator_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0230.986] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCalculator_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0231.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.024] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.031] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.079] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.095] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.099] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.106] CloseHandle (hObject=0x19c) returned 1 [0231.106] CloseHandle (hObject=0x1a0) returned 1 [0231.107] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.108] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\microsoft.windowscamera_5.38.3003.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.108] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Microsoft.WindowsCamera_5.38.3003.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0231.111] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.111] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.118] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.164] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.179] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.183] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.190] CloseHandle (hObject=0x198) returned 1 [0231.190] CloseHandle (hObject=0x1a0) returned 1 [0231.190] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.191] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscamera_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.191] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsCamera_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0231.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.229] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.236] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.386] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.404] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.408] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.414] CloseHandle (hObject=0x198) returned 1 [0231.415] CloseHandle (hObject=0x19c) returned 1 [0231.415] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.416] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.416] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\microsoft.windowscommunicationsapps_17.6002.42251.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0231.422] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.422] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.429] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.493] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.500] CloseHandle (hObject=0x1a0) returned 1 [0231.500] CloseHandle (hObject=0x19c) returned 1 [0231.500] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.501] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.501] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535400 [0231.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.519] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.526] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.571] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.587] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.598] CloseHandle (hObject=0x1a0) returned 1 [0231.598] CloseHandle (hObject=0x198) returned 1 [0231.598] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.599] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\microsoft.windowsfeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.599] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Microsoft.WindowsFeedback_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0231.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.603] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.610] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.656] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.673] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.684] CloseHandle (hObject=0x19c) returned 1 [0231.684] CloseHandle (hObject=0x198) returned 1 [0231.684] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.685] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsfeedback_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.685] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsFeedback_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0231.693] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.694] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.701] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.758] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.773] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.785] CloseHandle (hObject=0x19c) returned 1 [0231.785] CloseHandle (hObject=0x1a0) returned 1 [0231.785] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.786] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\microsoft.windowsmaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.786] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Microsoft.WindowsMaps_4.1505.50619.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0231.789] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0231.790] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0231.797] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0231.864] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0231.880] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0231.884] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.891] CloseHandle (hObject=0x198) returned 1 [0231.891] CloseHandle (hObject=0x1a0) returned 1 [0231.891] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0231.892] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsmaps_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0231.892] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsMaps_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0232.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.080] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.087] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.165] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.180] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.184] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.191] CloseHandle (hObject=0x198) returned 1 [0232.191] CloseHandle (hObject=0x19c) returned 1 [0232.191] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.193] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\microsoft.windowsphone_10.1506.20010.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0232.193] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Microsoft.WindowsPhone_10.1506.20010.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0232.196] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.196] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.204] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.279] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.295] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.298] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.305] CloseHandle (hObject=0x1a0) returned 1 [0232.305] CloseHandle (hObject=0x19c) returned 1 [0232.305] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.306] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsphone_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0232.306] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsPhone_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0232.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.370] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.377] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.437] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.452] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.456] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.462] CloseHandle (hObject=0x1a0) returned 1 [0232.463] CloseHandle (hObject=0x198) returned 1 [0232.463] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.464] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\microsoft.windowssoundrecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0232.464] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Microsoft.WindowsSoundRecorder_10.1506.15100.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0232.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.467] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.474] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.518] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.533] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.537] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.544] CloseHandle (hObject=0x19c) returned 1 [0232.544] CloseHandle (hObject=0x198) returned 1 [0232.544] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.545] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowssoundrecorder_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0232.545] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0232.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.548] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.554] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.598] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.613] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.617] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.623] CloseHandle (hObject=0x19c) returned 1 [0232.623] CloseHandle (hObject=0x1a0) returned 1 [0232.623] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.624] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0232.624] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCache\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535400 [0232.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.625] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.632] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.675] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.691] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.695] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.702] CloseHandle (hObject=0x1a0) returned 1 [0232.702] CloseHandle (hObject=0x19c) returned 1 [0232.702] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcookies\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.703] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\ac\\inetcookies\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0232.703] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\INetCookies\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0232.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.716] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.723] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.782] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.799] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.803] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.810] CloseHandle (hObject=0x19c) returned 1 [0232.810] CloseHandle (hObject=0x1a0) returned 1 [0232.811] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.812] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\microsoft.windowsstore_2015.7.1.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0232.812] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Microsoft.WindowsStore_2015.7.1.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0232.830] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.830] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.837] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0232.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0232.910] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0232.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.939] CloseHandle (hObject=0x198) returned 1 [0232.939] CloseHandle (hObject=0x1a0) returned 1 [0232.939] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0232.940] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.windowsstore_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0232.940] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0232.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0232.979] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0232.986] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.089] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.104] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.108] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.114] CloseHandle (hObject=0x198) returned 1 [0233.114] CloseHandle (hObject=0x19c) returned 1 [0233.114] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.116] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\microsoft.xboxapp_5.6.17000.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.116] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Microsoft.XboxApp_5.6.17000.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5351c0 [0233.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.119] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.127] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.171] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.187] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.191] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.198] CloseHandle (hObject=0x1a0) returned 1 [0233.198] CloseHandle (hObject=0x19c) returned 1 [0233.198] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.199] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxapp_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.199] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxApp_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0233.222] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.222] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.229] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.287] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.303] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.306] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.372] CloseHandle (hObject=0x1a0) returned 1 [0233.372] CloseHandle (hObject=0x198) returned 1 [0233.372] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\microsoft.xboxgamecallableui_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.373] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535300 [0233.378] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.378] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.385] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.431] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.446] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.450] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.457] CloseHandle (hObject=0x19c) returned 1 [0233.457] CloseHandle (hObject=0x198) returned 1 [0233.457] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.458] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxgamecallableui_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.458] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0233.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.483] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.490] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.537] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.554] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.559] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.567] CloseHandle (hObject=0x19c) returned 1 [0233.567] CloseHandle (hObject=0x1a0) returned 1 [0233.567] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.568] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\microsoft.xboxidentityprovider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.568] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Microsoft.XboxIdentityProvider_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x5353c0 [0233.573] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.573] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.581] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.672] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.677] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.687] CloseHandle (hObject=0x198) returned 1 [0233.687] CloseHandle (hObject=0x1a0) returned 1 [0233.687] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.689] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.xboxidentityprovider_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.689] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.XboxIdentityProvider_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0233.718] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.719] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.727] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.789] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.808] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.814] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.823] CloseHandle (hObject=0x198) returned 1 [0233.823] CloseHandle (hObject=0x19c) returned 1 [0233.824] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.833] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\microsoft.zunemusic_3.6.10841.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.834] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Microsoft.ZuneMusic_3.6.10841.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534f40 [0233.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0233.838] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0233.849] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0233.897] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0233.914] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0233.919] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.926] CloseHandle (hObject=0x1a0) returned 1 [0233.926] CloseHandle (hObject=0x19c) returned 1 [0233.926] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0233.927] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunemusic_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0233.927] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneMusic_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0234.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0234.030] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0234.038] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0234.105] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0234.127] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0234.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.141] CloseHandle (hObject=0x1a0) returned 1 [0234.141] CloseHandle (hObject=0x198) returned 1 [0234.142] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0234.142] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\microsoft.zunevideo_3.6.10811.0_x64__8wekyb3d8bbwe\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0234.143] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Microsoft.ZuneVideo_3.6.10811.0_x64__8wekyb3d8bbwe\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0234.146] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0234.146] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0234.153] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0234.211] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0234.232] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0234.237] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.246] CloseHandle (hObject=0x19c) returned 1 [0234.246] CloseHandle (hObject=0x198) returned 1 [0234.246] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0234.247] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\microsoft.zunevideo_8wekyb3d8bbwe\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0234.247] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Microsoft.ZuneVideo_8wekyb3d8bbwe\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0234.257] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0234.257] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0234.267] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0234.382] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0234.398] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0234.403] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.410] CloseHandle (hObject=0x198) returned 1 [0234.410] CloseHandle (hObject=0x19c) returned 1 [0234.410] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0234.411] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0234.411] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0234.415] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0234.415] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0234.423] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0234.485] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0234.503] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0234.507] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.514] CloseHandle (hObject=0x198) returned 1 [0234.514] CloseHandle (hObject=0x1a0) returned 1 [0234.515] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0234.516] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\windows.contactsupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0234.516] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\Windows.ContactSupport_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535040 [0234.520] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0234.521] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0234.528] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0234.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0234.608] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0234.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.619] CloseHandle (hObject=0x19c) returned 1 [0234.619] CloseHandle (hObject=0x1a0) returned 1 [0234.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0234.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.devicesflow_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0234.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.devicesflow_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0235.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.126] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.133] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.178] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.193] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.197] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.204] CloseHandle (hObject=0x1a0) returned 1 [0235.204] CloseHandle (hObject=0x19c) returned 1 [0235.204] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.205] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.205] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\windows.immersivecontrolpanel_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e80 [0235.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.229] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.236] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.280] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.296] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.300] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.307] CloseHandle (hObject=0x19c) returned 1 [0235.307] CloseHandle (hObject=0x1a0) returned 1 [0235.307] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.308] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.miracastview_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.308] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.MiracastView_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0235.350] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.350] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.357] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.403] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.419] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.423] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.430] CloseHandle (hObject=0x1a0) returned 1 [0235.430] CloseHandle (hObject=0x19c) returned 1 [0235.430] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.431] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.printdialog_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.431] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PrintDialog_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0235.451] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.451] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.458] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.515] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.530] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.540] CloseHandle (hObject=0x19c) returned 1 [0235.540] CloseHandle (hObject=0x1a0) returned 1 [0235.541] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.542] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\settings\\settings.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.542] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Settings\\settings.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0235.546] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.546] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.553] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.597] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.613] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.616] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.624] CloseHandle (hObject=0x19c) returned 1 [0235.624] CloseHandle (hObject=0x198) returned 1 [0235.624] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.625] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\packages\\windows.purchasedialog_cw5n1h2txyewy\\windows.purchasedialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\activationstore.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Packages\\Windows.PurchaseDialog_cw5n1h2txyewy\\Windows.PurchaseDialog_6.2.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\ActivationStore.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x535000 [0235.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.632] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.639] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.720] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.724] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.744] CloseHandle (hObject=0x194) returned 1 [0235.744] CloseHandle (hObject=0x190) returned 1 [0235.745] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\0H3r-sVpCP-CG-_M9.mkv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\0h3r-svpcp-cg-_m9.mkv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\0H3r-sVpCP-CG-_M9.mkv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\0h3r-svpcp-cg-_m9.mkv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.746] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\0H3r-sVpCP-CG-_M9.mkv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\0h3r-svpcp-cg-_m9.mkv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.746] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\0H3r-sVpCP-CG-_M9.mkv", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535180 [0235.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.748] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.755] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.802] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.817] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.821] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.835] CloseHandle (hObject=0x190) returned 1 [0235.835] CloseHandle (hObject=0x194) returned 1 [0235.835] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\89Qg95f9dPew.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\89qg95f9dpew.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\89Qg95f9dPew.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\89qg95f9dpew.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.836] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\89Qg95f9dPew.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\89qg95f9dpew.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.836] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\89Qg95f9dPew.avi", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0235.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.839] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.848] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.910] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0235.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.921] CloseHandle (hObject=0x194) returned 1 [0235.921] CloseHandle (hObject=0x190) returned 1 [0235.921] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AmpA-.pdf" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ampa-.pdf"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AmpA-.pdf.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ampa-.pdf.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0235.922] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AmpA-.pdf.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ampa-.pdf.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0235.922] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AmpA-.pdf", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534f40 [0235.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0235.924] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0235.931] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0235.980] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0235.996] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.000] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.006] CloseHandle (hObject=0x190) returned 1 [0236.006] CloseHandle (hObject=0x194) returned 1 [0236.007] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AS-vewG0loHZacuQp.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\as-vewg0lohzacuqp.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AS-vewG0loHZacuQp.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\as-vewg0lohzacuqp.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.008] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AS-vewG0loHZacuQp.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\as-vewg0lohzacuqp.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.008] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\AS-vewG0loHZacuQp.png", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534d00 [0236.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.010] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.018] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.065] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.081] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.092] CloseHandle (hObject=0x194) returned 1 [0236.092] CloseHandle (hObject=0x190) returned 1 [0236.092] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Bfb34-dQZkZ.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\bfb34-dqzkz.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Bfb34-dQZkZ.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\bfb34-dqzkz.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.093] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Bfb34-dQZkZ.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\bfb34-dqzkz.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.093] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Bfb34-dQZkZ.mp4", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535040 [0236.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.095] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.102] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.158] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.173] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.177] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.183] CloseHandle (hObject=0x190) returned 1 [0236.183] CloseHandle (hObject=0x194) returned 1 [0236.184] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\bg_t8dr77r7BF.doc" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\bg_t8dr77r7bf.doc"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\bg_t8dr77r7BF.doc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\bg_t8dr77r7bf.doc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.185] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\bg_t8dr77r7BF.doc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\bg_t8dr77r7bf.doc.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.185] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\bg_t8dr77r7BF.doc", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e40 [0236.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.187] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.195] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.240] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.256] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.260] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.267] CloseHandle (hObject=0x194) returned 1 [0236.267] CloseHandle (hObject=0x190) returned 1 [0236.267] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\eYA8LYqZcL_bNVHiYb.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\eya8lyqzcl_bnvhiyb.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\eYA8LYqZcL_bNVHiYb.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\eya8lyqzcl_bnvhiyb.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.268] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\eYA8LYqZcL_bNVHiYb.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\eya8lyqzcl_bnvhiyb.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.268] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\eYA8LYqZcL_bNVHiYb.mp3", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535300 [0236.269] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.270] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.276] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.412] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.428] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.432] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.439] CloseHandle (hObject=0x190) returned 1 [0236.439] CloseHandle (hObject=0x194) returned 1 [0236.439] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\G51SpXYe8sOx8MB.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\g51spxye8sox8mb.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\G51SpXYe8sOx8MB.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\g51spxye8sox8mb.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.440] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\G51SpXYe8sOx8MB.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\g51spxye8sox8mb.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.441] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\G51SpXYe8sOx8MB.bmp", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e40 [0236.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.443] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.449] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.495] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.513] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.517] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.523] CloseHandle (hObject=0x194) returned 1 [0236.523] CloseHandle (hObject=0x190) returned 1 [0236.523] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\geBDHMGW.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\gebdhmgw.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\geBDHMGW.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\gebdhmgw.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.524] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\geBDHMGW.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\gebdhmgw.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.524] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\geBDHMGW.gif", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534c80 [0236.526] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.526] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.533] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.580] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.596] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.600] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.607] CloseHandle (hObject=0x190) returned 1 [0236.607] CloseHandle (hObject=0x194) returned 1 [0236.607] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Hzg8nVL5LeRkK2Q-XbDu.docx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\hzg8nvl5lerkk2q-xbdu.docx"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Hzg8nVL5LeRkK2Q-XbDu.docx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\hzg8nvl5lerkk2q-xbdu.docx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.608] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Hzg8nVL5LeRkK2Q-XbDu.docx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\hzg8nvl5lerkk2q-xbdu.docx.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.608] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Hzg8nVL5LeRkK2Q-XbDu.docx", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535300 [0236.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.610] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.617] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.664] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.680] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.683] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.690] CloseHandle (hObject=0x194) returned 1 [0236.691] CloseHandle (hObject=0x190) returned 1 [0236.691] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nvEwA7G3hzj.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nvewa7g3hzj.pps"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nvEwA7G3hzj.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nvewa7g3hzj.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.692] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nvEwA7G3hzj.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\nvewa7g3hzj.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\nvEwA7G3hzj.pps", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e40 [0236.694] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.695] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.702] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.748] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.763] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.767] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.774] CloseHandle (hObject=0x190) returned 1 [0236.774] CloseHandle (hObject=0x194) returned 1 [0236.774] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qlwVL.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\qlwvl.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qlwVL.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\qlwvl.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.775] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qlwVL.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\qlwvl.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.775] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qlwVL.jpg", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0236.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.777] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.784] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.833] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.849] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.853] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.859] CloseHandle (hObject=0x194) returned 1 [0236.859] CloseHandle (hObject=0x190) returned 1 [0236.860] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qUqO.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\quqo.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qUqO.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\quqo.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.860] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qUqO.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\quqo.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.861] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\qUqO.gif", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534e80 [0236.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.862] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.869] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.916] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0236.931] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0236.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.941] CloseHandle (hObject=0x190) returned 1 [0236.941] CloseHandle (hObject=0x194) returned 1 [0236.942] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rCfAocJoY04W wEO7Z.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rcfaocjoy04w weo7z.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rCfAocJoY04W wEO7Z.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rcfaocjoy04w weo7z.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0236.942] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rCfAocJoY04W wEO7Z.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\rcfaocjoy04w weo7z.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0236.943] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\rCfAocJoY04W wEO7Z.gif", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535000 [0236.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0236.945] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0236.952] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0236.997] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.012] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.023] CloseHandle (hObject=0x194) returned 1 [0237.024] CloseHandle (hObject=0x190) returned 1 [0237.024] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\uzADyBk.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\uzadybk.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\uzADyBk.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\uzadybk.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.025] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\uzADyBk.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\uzadybk.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.025] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\uzADyBk.avi", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534ec0 [0237.040] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.040] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.047] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.104] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.119] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.123] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.130] CloseHandle (hObject=0x190) returned 1 [0237.130] CloseHandle (hObject=0x194) returned 1 [0237.130] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Vh7ycxg1B7_6Z9egi.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\vh7ycxg1b7_6z9egi.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Vh7ycxg1B7_6Z9egi.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\vh7ycxg1b7_6z9egi.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.131] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Vh7ycxg1B7_6Z9egi.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\vh7ycxg1b7_6z9egi.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.131] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\Vh7ycxg1B7_6Z9egi.jpg", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535200 [0237.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.133] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.140] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.182] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.200] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.204] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.210] CloseHandle (hObject=0x194) returned 1 [0237.210] CloseHandle (hObject=0x190) returned 1 [0237.211] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\X fqaW Nt0qfybgzNx.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\x fqaw nt0qfybgznx.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\X fqaW Nt0qfybgzNx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\x fqaw nt0qfybgznx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.211] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\X fqaW Nt0qfybgzNx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\x fqaw nt0qfybgznx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.211] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\X fqaW Nt0qfybgzNx.mp3", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x535000 [0237.213] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.213] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.220] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.271] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.289] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.293] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.299] CloseHandle (hObject=0x190) returned 1 [0237.299] CloseHandle (hObject=0x194) returned 1 [0237.300] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\YcLuDpHR.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ycludphr.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\YcLuDpHR.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ycludphr.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.301] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\YcLuDpHR.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\ycludphr.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.301] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\YcLuDpHR.bmp", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x5353c0 [0237.303] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.303] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.382] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.427] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.442] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.446] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.453] CloseHandle (hObject=0x194) returned 1 [0237.453] CloseHandle (hObject=0x190) returned 1 [0237.453] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\zuclFx.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\zuclfx.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\zuclFx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\zuclfx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.454] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\zuclFx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\zuclfx.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.454] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\zuclFx.mp3", lpFindFileData=0x19f078 | out: lpFindFileData=0x19f078) returned 0x534ec0 [0237.456] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.456] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.463] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.508] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.524] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.527] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.534] CloseHandle (hObject=0x194) returned 1 [0237.534] CloseHandle (hObject=0x1a0) returned 1 [0237.535] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.chk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.535] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.chk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.536] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.chk", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534ec0 [0237.537] CloseHandle (hObject=0xffffffff) returned 1 [0237.537] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.537] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0237.537] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x5351c0 [0237.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.538] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.545] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.663] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.681] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.684] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.691] CloseHandle (hObject=0x1a0) returned 1 [0237.691] CloseHandle (hObject=0x194) returned 1 [0237.691] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb00006.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb00006.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.692] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edb00006.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0237.692] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDB00006.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535400 [0237.700] CloseHandle (hObject=0xffffffff) returned 1 [0237.700] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbtmp.log"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.700] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\tiledatalayer\\database\\edbtmp.log.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0xffffffff [0237.700] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\TileDataLayer\\Database\\EDBtmp.log", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0237.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.743] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.750] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.805] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.831] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.837] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.846] CloseHandle (hObject=0x1a0) returned 1 [0237.846] CloseHandle (hObject=0x198) returned 1 [0237.846] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.847] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0237.847] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0237.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.851] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.861] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0237.920] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0237.938] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0237.943] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.953] CloseHandle (hObject=0x198) returned 1 [0237.953] CloseHandle (hObject=0x1a0) returned 1 [0237.953] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0237.954] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emiebrowsermodelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0237.954] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieBrowserModeList\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0237.955] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0237.956] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0237.965] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.015] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.031] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.035] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.042] CloseHandle (hObject=0x1a0) returned 1 [0238.042] CloseHandle (hObject=0x198) returned 1 [0238.042] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emiesitelist\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emiesitelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.043] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emiesitelist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0238.043] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieSiteList\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0238.044] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.044] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.051] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.096] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.112] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.115] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.122] CloseHandle (hObject=0x198) returned 1 [0238.123] CloseHandle (hObject=0x1a0) returned 1 [0238.123] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emieuserlist\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emieuserlist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.124] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\internet explorer\\emieuserlist\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0238.124] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\EmieUserList\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534dc0 [0238.125] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.125] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.132] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.176] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.191] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.195] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.204] CloseHandle (hObject=0x1a0) returned 1 [0238.204] CloseHandle (hObject=0x198) returned 1 [0238.204] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\windows\\appcache\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\windows\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.205] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\windows\\appcache\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0238.205] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\container.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0238.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.206] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.213] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.255] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.271] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.274] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.281] CloseHandle (hObject=0x1a0) returned 1 [0238.281] CloseHandle (hObject=0x19c) returned 1 [0238.281] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\W91W3IB2\\container.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\windows\\appcache\\w91w3ib2\\container.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\W91W3IB2\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\windows\\appcache\\w91w3ib2\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.282] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\W91W3IB2\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\locallow\\microsoft\\windows\\appcache\\w91w3ib2\\container.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x2020 [0238.282] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\LocalLow\\Microsoft\\Windows\\AppCache\\W91W3IB2\\container.dat", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0238.285] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.285] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.292] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.457] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.477] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.482] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.490] CloseHandle (hObject=0x18c) returned 1 [0238.490] CloseHandle (hObject=0x190) returned 1 [0238.490] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2xfSIdEl9vVp61Eh.mp4" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2xfsidel9vvp61eh.mp4"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2xfSIdEl9vVp61Eh.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2xfsidel9vvp61eh.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.491] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2xfSIdEl9vVp61Eh.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2xfsidel9vvp61eh.mp4.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0238.491] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2xfSIdEl9vVp61Eh.mp4", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535180 [0238.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.498] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.505] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.568] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.611] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.615] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.623] CloseHandle (hObject=0x190) returned 1 [0238.623] CloseHandle (hObject=0x18c) returned 1 [0238.623] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2YiQRQqAkWhuFjLd.ppt" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2yiqrqqakwhufjld.ppt"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2YiQRQqAkWhuFjLd.ppt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2yiqrqqakwhufjld.ppt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.624] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2YiQRQqAkWhuFjLd.ppt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\2yiqrqqakwhufjld.ppt.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0238.624] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\2YiQRQqAkWhuFjLd.ppt", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534dc0 [0238.627] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.627] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.636] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.685] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.706] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.710] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.717] CloseHandle (hObject=0x18c) returned 1 [0238.717] CloseHandle (hObject=0x190) returned 1 [0238.718] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4KoodYalmJAPdaI5klc.pps" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4koodyalmjapdai5klc.pps"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4KoodYalmJAPdaI5klc.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4koodyalmjapdai5klc.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.719] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4KoodYalmJAPdaI5klc.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\4koodyalmjapdai5klc.pps.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0238.719] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\4KoodYalmJAPdaI5klc.pps", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534d00 [0238.721] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.721] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.728] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.774] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.789] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.793] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.799] CloseHandle (hObject=0x190) returned 1 [0238.799] CloseHandle (hObject=0x18c) returned 1 [0238.800] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5lhJngrTd-GMXbJ.flv" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\5lhjngrtd-gmxbj.flv"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5lhJngrTd-GMXbJ.flv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\5lhjngrtd-gmxbj.flv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.800] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5lhJngrTd-GMXbJ.flv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\5lhjngrtd-gmxbj.flv.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0238.800] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\5lhJngrTd-GMXbJ.flv", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535180 [0238.803] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.803] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.810] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.860] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.875] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.879] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.885] CloseHandle (hObject=0x18c) returned 1 [0238.885] CloseHandle (hObject=0x190) returned 1 [0238.885] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7uum4hcF9QGr_CD.png" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7uum4hcf9qgr_cd.png"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7uum4hcF9QGr_CD.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7uum4hcf9qgr_cd.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0238.886] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7uum4hcF9QGr_CD.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\7uum4hcf9qgr_cd.png.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0238.886] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\7uum4hcF9QGr_CD.png", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535180 [0238.914] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0238.914] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0238.921] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0238.976] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0238.991] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0238.995] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.003] CloseHandle (hObject=0x194) returned 1 [0239.003] CloseHandle (hObject=0x198) returned 1 [0239.004] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.005] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\adobe\\logtransport2\\logtransport2.cfg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.005] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Adobe\\LogTransport2\\LogTransport2.cfg", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x535000 [0239.007] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.007] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.014] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.063] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.080] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.084] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.091] CloseHandle (hObject=0x190) returned 1 [0239.091] CloseHandle (hObject=0x18c) returned 1 [0239.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\aVLCDYOGT6PEn3 HSKh.gif" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\avlcdyogt6pen3 hskh.gif"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\aVLCDYOGT6PEn3 HSKh.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\avlcdyogt6pen3 hskh.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\aVLCDYOGT6PEn3 HSKh.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\avlcdyogt6pen3 hskh.gif.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\aVLCDYOGT6PEn3 HSKh.gif", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534e40 [0239.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.094] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.101] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.149] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.165] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.169] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.176] CloseHandle (hObject=0x18c) returned 1 [0239.176] CloseHandle (hObject=0x190) returned 1 [0239.176] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\B-gPqbs5V1_loY.jpg" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\b-gpqbs5v1_loy.jpg"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\B-gPqbs5V1_loY.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\b-gpqbs5v1_loy.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.177] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\B-gPqbs5V1_loY.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\b-gpqbs5v1_loy.jpg.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.177] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\B-gPqbs5V1_loY.jpg", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534e80 [0239.179] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.179] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.186] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.248] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.251] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.258] CloseHandle (hObject=0x190) returned 1 [0239.258] CloseHandle (hObject=0x18c) returned 1 [0239.258] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\b9wlsE3R.bmp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\b9wlse3r.bmp"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\b9wlsE3R.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\b9wlse3r.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.259] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\b9wlsE3R.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\b9wlse3r.bmp.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.259] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\b9wlsE3R.bmp", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535300 [0239.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.263] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.269] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.404] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.421] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.432] CloseHandle (hObject=0x18c) returned 1 [0239.432] CloseHandle (hObject=0x190) returned 1 [0239.432] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\giTsgEGHeLKCPKPT.mp3" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gitsgeghelkcpkpt.mp3"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\giTsgEGHeLKCPKPT.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gitsgeghelkcpkpt.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.433] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\giTsgEGHeLKCPKPT.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\gitsgeghelkcpkpt.mp3.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.433] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\giTsgEGHeLKCPKPT.mp3", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x535180 [0239.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.436] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.443] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.489] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.504] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.508] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.516] CloseHandle (hObject=0x190) returned 1 [0239.516] CloseHandle (hObject=0x18c) returned 1 [0239.516] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KSik.avi" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ksik.avi"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KSik.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ksik.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.517] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KSik.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\ksik.avi.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.517] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\KSik.avi", lpFindFileData=0x19f2e0 | out: lpFindFileData=0x19f2e0) returned 0x534cc0 [0239.520] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.520] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.527] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.618] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.635] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.639] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.647] CloseHandle (hObject=0x198) returned 1 [0239.647] CloseHandle (hObject=0x194) returned 1 [0239.647] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\System.mdw" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\access\\system.mdw"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\access\\system.mdw.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.648] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\System.mdw.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\access\\system.mdw.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.648] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Access\\System.mdw", lpFindFileData=0x19ee10 | out: lpFindFileData=0x19ee10) returned 0x534e80 [0239.686] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.687] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.694] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.749] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.767] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.771] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.778] CloseHandle (hObject=0x198) returned 1 [0239.778] CloseHandle (hObject=0x19c) returned 1 [0239.778] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.779] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.779] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534dc0 [0239.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.781] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.788] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.857] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.873] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.878] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.885] CloseHandle (hObject=0x19c) returned 1 [0239.885] CloseHandle (hObject=0x198) returned 1 [0239.885] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.886] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.886] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534cc0 [0239.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.888] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.896] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0239.951] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0239.967] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0239.971] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.978] CloseHandle (hObject=0x198) returned 1 [0239.978] CloseHandle (hObject=0x19c) returned 1 [0239.978] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0239.979] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0239.979] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0239.980] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0239.981] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0239.988] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.035] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.054] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.060] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.070] CloseHandle (hObject=0x19c) returned 1 [0240.070] CloseHandle (hObject=0x198) returned 1 [0240.070] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.072] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.072] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0240.076] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.076] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.090] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.148] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.193] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.217] CloseHandle (hObject=0x1a0) returned 1 [0240.217] CloseHandle (hObject=0x1a4) returned 1 [0240.218] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.221] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.221] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0240.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.230] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.247] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.299] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.413] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.417] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.424] CloseHandle (hObject=0x1a4) returned 1 [0240.424] CloseHandle (hObject=0x1a0) returned 1 [0240.425] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.426] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.426] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e80 [0240.430] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.431] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.439] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.487] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.503] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.507] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.515] CloseHandle (hObject=0x1a0) returned 1 [0240.515] CloseHandle (hObject=0x1a4) returned 1 [0240.515] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.517] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.517] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534ec0 [0240.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.520] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.527] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.578] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.597] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.600] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.607] CloseHandle (hObject=0x1a4) returned 1 [0240.607] CloseHandle (hObject=0x1a0) returned 1 [0240.608] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.609] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.609] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0240.612] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.613] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.619] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.663] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.679] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.682] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.689] CloseHandle (hObject=0x1a0) returned 1 [0240.690] CloseHandle (hObject=0x1a4) returned 1 [0240.690] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.691] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.691] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534dc0 [0240.694] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.694] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.701] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.770] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.774] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.781] CloseHandle (hObject=0x1a4) returned 1 [0240.781] CloseHandle (hObject=0x1a0) returned 1 [0240.782] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.783] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.783] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0240.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.787] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.794] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.846] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.874] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.878] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.892] CloseHandle (hObject=0x1a0) returned 1 [0240.892] CloseHandle (hObject=0x1a4) returned 1 [0240.893] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.895] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.895] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535240 [0240.898] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.898] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.904] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0240.952] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0240.973] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0240.978] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.984] CloseHandle (hObject=0x1a4) returned 1 [0240.984] CloseHandle (hObject=0x1a0) returned 1 [0240.985] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\project 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0240.986] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\project 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0240.986] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Project 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534dc0 [0240.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0240.990] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0240.997] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0241.042] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0241.184] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0241.187] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.284] CloseHandle (hObject=0x1a0) returned 1 [0241.284] CloseHandle (hObject=0x1a4) returned 1 [0241.285] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\visio 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0241.286] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\visio 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0241.286] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Visio 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534dc0 [0241.403] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0241.403] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0241.411] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0241.471] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0241.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0241.511] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.519] CloseHandle (hObject=0x1a4) returned 1 [0241.519] CloseHandle (hObject=0x1a0) returned 1 [0241.519] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0241.520] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0241.520] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534dc0 [0241.540] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0241.540] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0241.547] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0241.606] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0241.628] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0241.631] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.639] CloseHandle (hObject=0x198) returned 1 [0241.639] CloseHandle (hObject=0x19c) returned 1 [0241.639] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0241.640] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0241.640] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0241.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0241.642] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0241.649] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0241.696] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0241.980] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0241.984] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.991] CloseHandle (hObject=0x1a0) returned 1 [0241.991] CloseHandle (hObject=0x1a4) returned 1 [0241.991] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0241.992] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0241.992] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0242.009] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.009] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.017] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.081] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.108] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.112] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.119] CloseHandle (hObject=0x19c) returned 1 [0242.119] CloseHandle (hObject=0x198) returned 1 [0242.119] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.120] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\database1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.120] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Database1.LNK", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0242.121] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.121] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.128] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.219] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.223] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.231] CloseHandle (hObject=0x198) returned 1 [0242.231] CloseHandle (hObject=0x19c) returned 1 [0242.231] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.232] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\documents.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.232] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Documents.LNK", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0242.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.234] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.240] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.292] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.369] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.380] CloseHandle (hObject=0x19c) returned 1 [0242.380] CloseHandle (hObject=0x198) returned 1 [0242.380] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.381] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\global.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.381] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Global.LNK", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0242.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.384] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.390] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.434] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.449] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.453] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.459] CloseHandle (hObject=0x198) returned 1 [0242.459] CloseHandle (hObject=0x19c) returned 1 [0242.459] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.460] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.460] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0242.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.462] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.469] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.522] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.537] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.541] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.548] CloseHandle (hObject=0x19c) returned 1 [0242.548] CloseHandle (hObject=0x198) returned 1 [0242.548] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.549] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.549] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0242.551] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.552] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.563] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.607] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.622] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.625] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.632] CloseHandle (hObject=0x198) returned 1 [0242.632] CloseHandle (hObject=0x19c) returned 1 [0242.632] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.633] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\onenote\\16.0\\preferences.dat.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.633] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\Preferences.dat", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0242.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.751] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.758] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.813] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.830] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.834] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.847] CloseHandle (hObject=0x19c) returned 1 [0242.848] CloseHandle (hObject=0x198) returned 1 [0242.848] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.849] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\accountpictures\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.849] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0242.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.852] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.859] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.907] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0242.925] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0242.930] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.937] CloseHandle (hObject=0x198) returned 1 [0242.937] CloseHandle (hObject=0x19c) returned 1 [0242.937] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0242.938] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0242.938] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0242.941] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0242.942] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0242.949] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0242.993] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.009] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.012] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.019] CloseHandle (hObject=0x19c) returned 1 [0243.019] CloseHandle (hObject=0x198) returned 1 [0243.019] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ET Yqwgu6eKQi.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\-et yqwgu6ekqi.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ET Yqwgu6eKQi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\-et yqwgu6ekqi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.020] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ET Yqwgu6eKQi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\-et yqwgu6ekqi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.020] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-ET Yqwgu6eKQi.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0243.021] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.022] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.029] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.074] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.089] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.093] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.101] CloseHandle (hObject=0x198) returned 1 [0243.101] CloseHandle (hObject=0x19c) returned 1 [0243.101] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0cOW.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\0cow.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0cOW.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\0cow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.102] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0cOW.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\0cow.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.102] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0cOW.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0243.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.104] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.111] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.155] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.184] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.187] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.194] CloseHandle (hObject=0x19c) returned 1 [0243.194] CloseHandle (hObject=0x198) returned 1 [0243.194] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1v7j1ZEzTKvWe.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\1v7j1zeztkvwe.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1v7j1ZEzTKvWe.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\1v7j1zeztkvwe.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.195] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1v7j1ZEzTKvWe.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\1v7j1zeztkvwe.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.195] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1v7j1ZEzTKvWe.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0243.197] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.197] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.204] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.249] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.265] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.269] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.276] CloseHandle (hObject=0x198) returned 1 [0243.276] CloseHandle (hObject=0x19c) returned 1 [0243.276] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_78CtA7rsFP.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\1_78cta7rsfp.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_78CtA7rsFP.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\1_78cta7rsfp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.277] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_78CtA7rsFP.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\1_78cta7rsfp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.277] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_78CtA7rsFP.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0243.278] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.279] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.286] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.440] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.443] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.450] CloseHandle (hObject=0x19c) returned 1 [0243.451] CloseHandle (hObject=0x198) returned 1 [0243.451] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ixt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\2ixt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ixt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\2ixt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.452] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ixt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\2ixt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.452] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2ixt.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0243.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.453] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.460] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.514] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.531] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.541] CloseHandle (hObject=0x198) returned 1 [0243.541] CloseHandle (hObject=0x19c) returned 1 [0243.541] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YiQRQqAkWhuFjLd.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\2yiqrqqakwhufjld.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YiQRQqAkWhuFjLd.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\2yiqrqqakwhufjld.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.542] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YiQRQqAkWhuFjLd.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\2yiqrqqakwhufjld.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.542] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2YiQRQqAkWhuFjLd.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0243.544] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.544] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.551] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.594] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.608] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.612] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.619] CloseHandle (hObject=0x19c) returned 1 [0243.619] CloseHandle (hObject=0x198) returned 1 [0243.619] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\35SY0.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\35sy0.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\35SY0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\35sy0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.620] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\35SY0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\35sy0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.620] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\35SY0.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0243.621] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.621] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.628] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.698] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.720] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.725] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.739] CloseHandle (hObject=0x198) returned 1 [0243.739] CloseHandle (hObject=0x19c) returned 1 [0243.739] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Ehag1UULQS8ZEz_ RGg.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4ehag1uulqs8zez_ rgg.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Ehag1UULQS8ZEz_ RGg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4ehag1uulqs8zez_ rgg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.740] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Ehag1UULQS8ZEz_ RGg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4ehag1uulqs8zez_ rgg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.740] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Ehag1UULQS8ZEz_ RGg.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0243.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.743] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.752] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.814] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.869] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.874] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.884] CloseHandle (hObject=0x19c) returned 1 [0243.884] CloseHandle (hObject=0x198) returned 1 [0243.884] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4J7h0W7 b1.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4j7h0w7 b1.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4J7h0W7 b1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4j7h0w7 b1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.885] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4J7h0W7 b1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4j7h0w7 b1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.885] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4J7h0W7 b1.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0243.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.887] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.896] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0243.944] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0243.976] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0243.980] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.986] CloseHandle (hObject=0x198) returned 1 [0243.986] CloseHandle (hObject=0x19c) returned 1 [0243.987] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4n_RTxfuaYL.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4n_rtxfuayl.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4n_RTxfuaYL.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4n_rtxfuayl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0243.988] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4n_RTxfuaYL.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\4n_rtxfuayl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0243.988] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4n_RTxfuaYL.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0243.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0243.992] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0243.999] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.086] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.107] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.111] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.118] CloseHandle (hObject=0x19c) returned 1 [0244.118] CloseHandle (hObject=0x198) returned 1 [0244.118] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bCAi4vFXRcl.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\6bcai4vfxrcl.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bCAi4vFXRcl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\6bcai4vfxrcl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.119] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bCAi4vFXRcl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\6bcai4vfxrcl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.119] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6bCAi4vFXRcl.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0244.121] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.121] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.128] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.211] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.227] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.238] CloseHandle (hObject=0x198) returned 1 [0244.238] CloseHandle (hObject=0x19c) returned 1 [0244.239] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6iQWgjaCfGaMMoTDltER.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\6iqwgjacfgammotdlter.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6iQWgjaCfGaMMoTDltER.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\6iqwgjacfgammotdlter.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.239] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6iQWgjaCfGaMMoTDltER.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\6iqwgjacfgammotdlter.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.240] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6iQWgjaCfGaMMoTDltER.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0244.242] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.242] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.249] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.293] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.399] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.402] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.409] CloseHandle (hObject=0x19c) returned 1 [0244.409] CloseHandle (hObject=0x198) returned 1 [0244.409] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8ajsJxbag (2).lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\8ajsjxbag (2).lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8ajsJxbag (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\8ajsjxbag (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.410] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8ajsJxbag (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\8ajsjxbag (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.410] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8ajsJxbag (2).lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0244.411] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.412] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.419] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.483] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.486] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.493] CloseHandle (hObject=0x198) returned 1 [0244.493] CloseHandle (hObject=0x19c) returned 1 [0244.493] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\94s3p-tE.ots.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\94s3p-te.ots.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\94s3p-tE.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\94s3p-te.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.494] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\94s3p-tE.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\94s3p-te.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.494] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\94s3p-tE.ots.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0244.496] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.496] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.503] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.557] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.578] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.592] CloseHandle (hObject=0x19c) returned 1 [0244.592] CloseHandle (hObject=0x198) returned 1 [0244.592] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9HwApcAfzInH4RjQOz4.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9hwapcafzinh4rjqoz4.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9HwApcAfzInH4RjQOz4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9hwapcafzinh4rjqoz4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.597] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9HwApcAfzInH4RjQOz4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9hwapcafzinh4rjqoz4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.597] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9HwApcAfzInH4RjQOz4.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0244.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.598] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.605] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.651] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.667] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.671] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.677] CloseHandle (hObject=0x198) returned 1 [0244.677] CloseHandle (hObject=0x19c) returned 1 [0244.678] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9wZJTHaYaKsO.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9wzjthayakso.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9wZJTHaYaKsO.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9wzjthayakso.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.678] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9wZJTHaYaKsO.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9wzjthayakso.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.679] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9wZJTHaYaKsO.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0244.680] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.681] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.687] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.736] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.752] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.755] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.765] CloseHandle (hObject=0x19c) returned 1 [0244.765] CloseHandle (hObject=0x198) returned 1 [0244.765] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9zRI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9zri.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9zRI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9zri.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.766] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9zRI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9zri.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.766] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9zRI.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0244.767] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.768] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.775] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.823] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.846] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.850] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.859] CloseHandle (hObject=0x198) returned 1 [0244.859] CloseHandle (hObject=0x19c) returned 1 [0244.859] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9_-t7Wng.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9_-t7wng.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9_-t7Wng.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9_-t7wng.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.860] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9_-t7Wng.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\9_-t7wng.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.860] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9_-t7Wng.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0244.861] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.862] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.868] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0244.916] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0244.932] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0244.937] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.943] CloseHandle (hObject=0x19c) returned 1 [0244.943] CloseHandle (hObject=0x198) returned 1 [0244.944] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACWEY_1w3.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\acwey_1w3.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACWEY_1w3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\acwey_1w3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0244.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACWEY_1w3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\acwey_1w3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0244.945] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ACWEY_1w3.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0244.947] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0244.948] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0244.955] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.002] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.018] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.022] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.029] CloseHandle (hObject=0x198) returned 1 [0245.029] CloseHandle (hObject=0x19c) returned 1 [0245.029] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AhX7NBAkipg_x4.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ahx7nbakipg_x4.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AhX7NBAkipg_x4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ahx7nbakipg_x4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.030] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AhX7NBAkipg_x4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ahx7nbakipg_x4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.030] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AhX7NBAkipg_x4.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0245.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.032] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.038] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.095] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.110] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.114] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.121] CloseHandle (hObject=0x19c) returned 1 [0245.121] CloseHandle (hObject=0x198) returned 1 [0245.121] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnjlA q19q7k2oYG.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\anjla q19q7k2oyg.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnjlA q19q7k2oYG.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\anjla q19q7k2oyg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.122] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnjlA q19q7k2oYG.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\anjla q19q7k2oyg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.122] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnjlA q19q7k2oYG.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0245.124] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.124] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.132] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.212] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.228] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.232] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.240] CloseHandle (hObject=0x198) returned 1 [0245.240] CloseHandle (hObject=0x19c) returned 1 [0245.240] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnQhps_F 7.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\anqhps_f 7.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnQhps_F 7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\anqhps_f 7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.242] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnQhps_F 7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\anqhps_f 7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.242] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AnQhps_F 7.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0245.244] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.244] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.251] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.295] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.362] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.366] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.372] CloseHandle (hObject=0x19c) returned 1 [0245.372] CloseHandle (hObject=0x198) returned 1 [0245.372] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aTFROV4.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\atfrov4.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aTFROV4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\atfrov4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.373] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aTFROV4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\atfrov4.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.373] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aTFROV4.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0245.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.383] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.390] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.436] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.451] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.455] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.462] CloseHandle (hObject=0x198) returned 1 [0245.462] CloseHandle (hObject=0x19c) returned 1 [0245.462] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMImNKmPh14MX.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\awmimnkmph14mx.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMImNKmPh14MX.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\awmimnkmph14mx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.463] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMImNKmPh14MX.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\awmimnkmph14mx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.463] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AWMImNKmPh14MX.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0245.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.465] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.472] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.531] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.534] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.543] CloseHandle (hObject=0x19c) returned 1 [0245.543] CloseHandle (hObject=0x198) returned 1 [0245.543] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AXb5vGmlRMsB_bUcS.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\axb5vgmlrmsb_bucs.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AXb5vGmlRMsB_bUcS.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\axb5vgmlrmsb_bucs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.544] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AXb5vGmlRMsB_bUcS.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\axb5vgmlrmsb_bucs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.544] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AXb5vGmlRMsB_bUcS.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0245.546] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.546] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.553] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.596] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.611] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.615] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.621] CloseHandle (hObject=0x198) returned 1 [0245.621] CloseHandle (hObject=0x19c) returned 1 [0245.621] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B-gPqbs5V1_loY.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\b-gpqbs5v1_loy.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B-gPqbs5V1_loY.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\b-gpqbs5v1_loy.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.622] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B-gPqbs5V1_loY.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\b-gpqbs5v1_loy.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.622] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B-gPqbs5V1_loY.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0245.624] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.624] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.630] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.674] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.689] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.700] CloseHandle (hObject=0x19c) returned 1 [0245.700] CloseHandle (hObject=0x198) returned 1 [0245.700] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3mqgE b03Cw1P1uB3.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\b3mqge b03cw1p1ub3.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3mqgE b03Cw1P1uB3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\b3mqge b03cw1p1ub3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.701] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3mqgE b03Cw1P1uB3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\b3mqge b03cw1p1ub3.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.701] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3mqgE b03Cw1P1uB3.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0245.702] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.702] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.709] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.754] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.769] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.776] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.782] CloseHandle (hObject=0x198) returned 1 [0245.782] CloseHandle (hObject=0x19c) returned 1 [0245.782] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bejkoNAwTvIvtE.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bejkonawtvivte.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bejkoNAwTvIvtE.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bejkonawtvivte.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.783] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bejkoNAwTvIvtE.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bejkonawtvivte.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.783] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bejkoNAwTvIvtE.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0245.785] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.785] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.792] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.842] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0245.871] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0245.877] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.890] CloseHandle (hObject=0x19c) returned 1 [0245.890] CloseHandle (hObject=0x198) returned 1 [0245.890] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bMUfLFlXWG2.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bmuflflxwg2.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bMUfLFlXWG2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bmuflflxwg2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0245.891] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bMUfLFlXWG2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bmuflflxwg2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0245.891] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bMUfLFlXWG2.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0245.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0245.893] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0245.903] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0245.982] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.011] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.016] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.048] CloseHandle (hObject=0x198) returned 1 [0246.048] CloseHandle (hObject=0x19c) returned 1 [0246.048] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRqkKTFQaRr7MxT.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\brqkktfqarr7mxt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRqkKTFQaRr7MxT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\brqkktfqarr7mxt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.049] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRqkKTFQaRr7MxT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\brqkktfqarr7mxt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.049] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bRqkKTFQaRr7MxT.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0246.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.051] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.087] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0246.247] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.263] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.267] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.274] CloseHandle (hObject=0x19c) returned 1 [0246.274] CloseHandle (hObject=0x198) returned 1 [0246.274] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BvsmTDi9e.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bvsmtdi9e.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BvsmTDi9e.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bvsmtdi9e.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.275] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BvsmTDi9e.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\bvsmtdi9e.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.275] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BvsmTDi9e.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0246.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.277] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.284] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0246.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.457] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.463] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.471] CloseHandle (hObject=0x198) returned 1 [0246.471] CloseHandle (hObject=0x19c) returned 1 [0246.471] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c82Lg6.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\c82lg6.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c82Lg6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\c82lg6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.472] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c82Lg6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\c82lg6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.472] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c82Lg6.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0246.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.474] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.481] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0246.538] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.574] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.579] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.586] CloseHandle (hObject=0x19c) returned 1 [0246.586] CloseHandle (hObject=0x198) returned 1 [0246.586] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CfI6YQwXMt-.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\cfi6yqwxmt-.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CfI6YQwXMt-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\cfi6yqwxmt-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.587] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CfI6YQwXMt-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\cfi6yqwxmt-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.587] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CfI6YQwXMt-.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0246.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.589] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.596] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0246.662] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.725] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.729] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.736] CloseHandle (hObject=0x198) returned 1 [0246.736] CloseHandle (hObject=0x19c) returned 1 [0246.736] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\coxZdYQ9urzPR.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\coxzdyq9urzpr.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\coxZdYQ9urzPR.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\coxzdyq9urzpr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.737] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\coxZdYQ9urzPR.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\coxzdyq9urzpr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.737] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\coxZdYQ9urzPR.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0246.779] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.779] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.786] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0246.834] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.858] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.861] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.868] CloseHandle (hObject=0x19c) returned 1 [0246.868] CloseHandle (hObject=0x198) returned 1 [0246.869] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CZJN68.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\czjn68.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CZJN68.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\czjn68.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.870] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CZJN68.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\czjn68.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.870] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CZJN68.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0246.871] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.871] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.878] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0246.939] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0246.954] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0246.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.965] CloseHandle (hObject=0x198) returned 1 [0246.965] CloseHandle (hObject=0x19c) returned 1 [0246.965] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0NqX 1qKhFaw.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\d0nqx 1qkhfaw.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0NqX 1qKhFaw.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\d0nqx 1qkhfaw.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0246.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0NqX 1qKhFaw.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\d0nqx 1qkhfaw.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0246.966] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D0NqX 1qKhFaw.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0246.967] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0246.967] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0246.974] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.019] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.036] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.052] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.059] CloseHandle (hObject=0x19c) returned 1 [0247.059] CloseHandle (hObject=0x198) returned 1 [0247.059] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DB4UnGV.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\db4ungv.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DB4UnGV.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\db4ungv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.060] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DB4UnGV.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\db4ungv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.060] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DB4UnGV.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0247.061] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.061] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.068] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.132] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.153] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.156] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.163] CloseHandle (hObject=0x198) returned 1 [0247.163] CloseHandle (hObject=0x19c) returned 1 [0247.163] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.167] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.167] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0247.169] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.169] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.176] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.220] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.236] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.239] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.247] CloseHandle (hObject=0x19c) returned 1 [0247.247] CloseHandle (hObject=0x198) returned 1 [0247.247] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dh7v5.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dh7v5.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dh7v5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dh7v5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.248] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dh7v5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dh7v5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.248] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dh7v5.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0247.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.250] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.256] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.304] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.415] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.419] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.426] CloseHandle (hObject=0x198) returned 1 [0247.426] CloseHandle (hObject=0x19c) returned 1 [0247.426] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DpYDeERjL0eK.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dpydeerjl0ek.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DpYDeERjL0eK.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dpydeerjl0ek.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.427] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DpYDeERjL0eK.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dpydeerjl0ek.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.427] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DpYDeERjL0eK.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0247.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.429] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.436] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.481] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.497] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.501] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.507] CloseHandle (hObject=0x19c) returned 1 [0247.507] CloseHandle (hObject=0x198) returned 1 [0247.507] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dqzq_Hk7fFLilE7.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dqzq_hk7fflile7.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dqzq_Hk7fFLilE7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dqzq_hk7fflile7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.509] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dqzq_Hk7fFLilE7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dqzq_hk7fflile7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.509] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dqzq_Hk7fFLilE7.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0247.510] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.510] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.517] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.561] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.577] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.581] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.589] CloseHandle (hObject=0x198) returned 1 [0247.589] CloseHandle (hObject=0x19c) returned 1 [0247.589] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DSdWn4jWgnAUoni.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dsdwn4jwgnauoni.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DSdWn4jWgnAUoni.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dsdwn4jwgnauoni.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.590] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DSdWn4jWgnAUoni.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dsdwn4jwgnauoni.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.591] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DSdWn4jWgnAUoni.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0247.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.592] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.599] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.675] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.690] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.694] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.701] CloseHandle (hObject=0x19c) returned 1 [0247.701] CloseHandle (hObject=0x198) returned 1 [0247.701] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dXLi8z3f.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dxli8z3f.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dXLi8z3f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dxli8z3f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.702] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dXLi8z3f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dxli8z3f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.702] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dXLi8z3f.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0247.704] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.704] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.758] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0247.859] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0247.875] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0247.878] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.932] CloseHandle (hObject=0x198) returned 1 [0247.932] CloseHandle (hObject=0x19c) returned 1 [0247.933] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dy_vzS.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dy_vzs.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dy_vzS.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dy_vzs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0247.934] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dy_vzS.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\dy_vzs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0247.934] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\dy_vzS.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0247.943] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0247.943] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0247.951] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0248.042] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0248.058] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0248.061] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.068] CloseHandle (hObject=0x19c) returned 1 [0248.068] CloseHandle (hObject=0x198) returned 1 [0248.068] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E0JW6P4QQdOpS_.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\e0jw6p4qqdops_.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E0JW6P4QQdOpS_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\e0jw6p4qqdops_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0248.069] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E0JW6P4QQdOpS_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\e0jw6p4qqdops_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0248.070] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\E0JW6P4QQdOpS_.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0248.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0248.119] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0248.128] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0248.221] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0248.300] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0248.304] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.464] CloseHandle (hObject=0x198) returned 1 [0248.464] CloseHandle (hObject=0x19c) returned 1 [0248.464] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eKd35IQo6N.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ekd35iqo6n.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eKd35IQo6N.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ekd35iqo6n.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0248.465] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eKd35IQo6N.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ekd35iqo6n.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0248.465] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eKd35IQo6N.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0248.466] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0248.467] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0248.473] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0248.566] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0248.581] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0248.585] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.592] CloseHandle (hObject=0x19c) returned 1 [0248.592] CloseHandle (hObject=0x198) returned 1 [0248.592] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eR3F0RZ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\er3f0rz.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eR3F0RZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\er3f0rz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0248.593] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eR3F0RZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\er3f0rz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0248.593] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eR3F0RZ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0248.595] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0248.595] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0248.649] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0248.695] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0248.758] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0248.761] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.768] CloseHandle (hObject=0x198) returned 1 [0248.768] CloseHandle (hObject=0x19c) returned 1 [0248.768] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewyaEkgukKSi.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ewyaekgukksi.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewyaEkgukKSi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ewyaekgukksi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0248.769] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewyaEkgukKSi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ewyaekgukksi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0248.769] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ewyaEkgukKSi.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0248.771] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0248.771] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0248.784] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0248.847] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0248.862] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0248.866] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.873] CloseHandle (hObject=0x19c) returned 1 [0248.873] CloseHandle (hObject=0x198) returned 1 [0248.873] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh7pHscUAiT8V gYT.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fh7phscuait8v gyt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh7pHscUAiT8V gYT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fh7phscuait8v gyt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0248.874] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh7pHscUAiT8V gYT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fh7phscuait8v gyt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0248.874] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fh7pHscUAiT8V gYT.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0248.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0248.876] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0248.915] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0248.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0249.022] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0249.025] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.032] CloseHandle (hObject=0x198) returned 1 [0249.033] CloseHandle (hObject=0x19c) returned 1 [0249.033] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FJv3YUy0uhGSJ01IkK.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fjv3yuy0uhgsj01ikk.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FJv3YUy0uhGSJ01IkK.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fjv3yuy0uhgsj01ikk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0249.034] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FJv3YUy0uhGSJ01IkK.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fjv3yuy0uhgsj01ikk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0249.034] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FJv3YUy0uhGSJ01IkK.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0249.035] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0249.035] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0249.087] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0249.131] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0249.194] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0249.198] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.205] CloseHandle (hObject=0x19c) returned 1 [0249.205] CloseHandle (hObject=0x198) returned 1 [0249.205] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqvj6pmatCj5lUN nDqc.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fqvj6pmatcj5lun ndqc.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqvj6pmatCj5lUN nDqc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fqvj6pmatcj5lun ndqc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0249.206] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqvj6pmatCj5lUN nDqc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fqvj6pmatcj5lun ndqc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0249.206] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fqvj6pmatCj5lUN nDqc.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0249.208] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0249.208] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0249.215] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0249.411] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0249.472] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0249.476] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.482] CloseHandle (hObject=0x198) returned 1 [0249.483] CloseHandle (hObject=0x19c) returned 1 [0249.483] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWEPgKUNixZSwGp0.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fwepgkunixzswgp0.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWEPgKUNixZSwGp0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fwepgkunixzswgp0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0249.484] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWEPgKUNixZSwGp0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fwepgkunixzswgp0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0249.484] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FWEPgKUNixZSwGp0.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0249.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0249.486] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0249.493] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0249.585] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0249.656] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0249.659] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.666] CloseHandle (hObject=0x19c) returned 1 [0249.666] CloseHandle (hObject=0x198) returned 1 [0249.666] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FXjVGB.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fxjvgb.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FXjVGB.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fxjvgb.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0249.667] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FXjVGB.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\fxjvgb.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0249.668] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FXjVGB.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0249.669] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0249.669] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0249.676] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0249.767] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0249.830] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0249.834] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.840] CloseHandle (hObject=0x198) returned 1 [0249.841] CloseHandle (hObject=0x19c) returned 1 [0249.841] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gf-eBjt-0.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gf-ebjt-0.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gf-eBjt-0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gf-ebjt-0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0249.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gf-eBjt-0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gf-ebjt-0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0249.842] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gf-eBjt-0.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0249.843] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0249.844] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0249.857] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0249.947] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0249.963] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0249.966] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.021] CloseHandle (hObject=0x19c) returned 1 [0250.021] CloseHandle (hObject=0x198) returned 1 [0250.021] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\giTsgEGHeLKCPKPT.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gitsgeghelkcpkpt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\giTsgEGHeLKCPKPT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gitsgeghelkcpkpt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0250.022] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\giTsgEGHeLKCPKPT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gitsgeghelkcpkpt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0250.022] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\giTsgEGHeLKCPKPT.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0250.023] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0250.024] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0250.030] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0250.121] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0250.139] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0250.145] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.154] CloseHandle (hObject=0x198) returned 1 [0250.154] CloseHandle (hObject=0x19c) returned 1 [0250.154] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gjc BSRDQ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gjc bsrdq.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gjc BSRDQ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gjc bsrdq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0250.155] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gjc BSRDQ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gjc bsrdq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0250.156] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gjc BSRDQ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0250.205] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0250.205] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0250.212] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0250.400] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0250.462] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0250.466] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.473] CloseHandle (hObject=0x19c) returned 1 [0250.473] CloseHandle (hObject=0x198) returned 1 [0250.473] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gSwKwAtURC.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gswkwaturc.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gSwKwAtURC.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gswkwaturc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0250.474] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gSwKwAtURC.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\gswkwaturc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0250.474] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gSwKwAtURC.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0250.475] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0250.475] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0250.482] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0250.573] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0250.631] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0250.636] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.646] CloseHandle (hObject=0x198) returned 1 [0250.646] CloseHandle (hObject=0x19c) returned 1 [0250.647] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GuebdifXPK.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\guebdifxpk.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GuebdifXPK.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\guebdifxpk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0250.648] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GuebdifXPK.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\guebdifxpk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0250.648] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GuebdifXPK.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0250.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0250.650] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0250.668] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0250.737] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0250.768] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0250.773] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.788] CloseHandle (hObject=0x19c) returned 1 [0250.788] CloseHandle (hObject=0x198) returned 1 [0250.788] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h45Yr_o_DpiJlMHAxJU.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\h45yr_o_dpijlmhaxju.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h45Yr_o_DpiJlMHAxJU.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\h45yr_o_dpijlmhaxju.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0250.789] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h45Yr_o_DpiJlMHAxJU.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\h45yr_o_dpijlmhaxju.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0250.789] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h45Yr_o_DpiJlMHAxJU.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0250.791] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0250.791] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0250.798] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0250.848] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0250.878] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0250.881] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.895] CloseHandle (hObject=0x198) returned 1 [0250.895] CloseHandle (hObject=0x19c) returned 1 [0250.936] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h6bXh8J.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\h6bxh8j.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h6bXh8J.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\h6bxh8j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0250.937] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h6bXh8J.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\h6bxh8j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0250.937] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\h6bXh8J.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0250.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0250.939] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0250.946] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.037] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.053] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.071] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.078] CloseHandle (hObject=0x19c) returned 1 [0251.078] CloseHandle (hObject=0x198) returned 1 [0251.078] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HBdvBLiPAYDTlaR.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\hbdvblipaydtlar.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HBdvBLiPAYDTlaR.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\hbdvblipaydtlar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.079] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HBdvBLiPAYDTlaR.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\hbdvblipaydtlar.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.079] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HBdvBLiPAYDTlaR.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0251.081] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.081] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.088] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.147] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.186] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.191] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.200] CloseHandle (hObject=0x198) returned 1 [0251.200] CloseHandle (hObject=0x19c) returned 1 [0251.200] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hImWt3Uq.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\himwt3uq.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hImWt3Uq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\himwt3uq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.201] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hImWt3Uq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\himwt3uq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.201] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hImWt3Uq.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0251.219] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.219] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.226] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.373] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.389] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.392] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.399] CloseHandle (hObject=0x19c) returned 1 [0251.399] CloseHandle (hObject=0x198) returned 1 [0251.400] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtUYjyVwXaBG.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\htuyjyvwxabg.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtUYjyVwXaBG.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\htuyjyvwxabg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.400] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtUYjyVwXaBG.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\htuyjyvwxabg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.401] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtUYjyVwXaBG.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0251.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.402] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.409] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.454] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.471] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.475] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.481] CloseHandle (hObject=0x198) returned 1 [0251.481] CloseHandle (hObject=0x19c) returned 1 [0251.482] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i 0u8b4v2qQ6sWB-L.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\i 0u8b4v2qq6swb-l.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i 0u8b4v2qQ6sWB-L.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\i 0u8b4v2qq6swb-l.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.483] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i 0u8b4v2qQ6sWB-L.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\i 0u8b4v2qq6swb-l.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.483] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i 0u8b4v2qQ6sWB-L.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0251.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.484] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.491] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.537] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.552] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.560] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.568] CloseHandle (hObject=0x19c) returned 1 [0251.568] CloseHandle (hObject=0x198) returned 1 [0251.568] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iC7TJ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ic7tj.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iC7TJ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ic7tj.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.569] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iC7TJ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ic7tj.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.569] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iC7TJ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0251.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.571] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.578] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.623] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.639] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.642] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.649] CloseHandle (hObject=0x198) returned 1 [0251.649] CloseHandle (hObject=0x19c) returned 1 [0251.650] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\icg4sL-2fzik68ByEn.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\icg4sl-2fzik68byen.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\icg4sL-2fzik68ByEn.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\icg4sl-2fzik68byen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.651] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\icg4sL-2fzik68ByEn.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\icg4sl-2fzik68byen.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.651] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\icg4sL-2fzik68ByEn.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0251.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.653] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.660] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.704] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.719] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.723] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.730] CloseHandle (hObject=0x19c) returned 1 [0251.730] CloseHandle (hObject=0x198) returned 1 [0251.732] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Imusq.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\imusq.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Imusq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\imusq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.733] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Imusq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\imusq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.734] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Imusq.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535240 [0251.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.736] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.745] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.789] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.805] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.809] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.816] CloseHandle (hObject=0x198) returned 1 [0251.816] CloseHandle (hObject=0x19c) returned 1 [0251.816] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\inyBs22rmM-aQ0G_li7f.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\inybs22rmm-aq0g_li7f.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\inyBs22rmM-aQ0G_li7f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\inybs22rmm-aq0g_li7f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.817] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\inyBs22rmM-aQ0G_li7f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\inybs22rmm-aq0g_li7f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.817] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\inyBs22rmM-aQ0G_li7f.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0251.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.819] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.826] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.877] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.894] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.897] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.904] CloseHandle (hObject=0x19c) returned 1 [0251.904] CloseHandle (hObject=0x198) returned 1 [0251.904] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iR9hW 02-7ZBoX8xd C.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ir9hw 02-7zbox8xd c.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iR9hW 02-7ZBoX8xd C.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ir9hw 02-7zbox8xd c.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.905] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iR9hW 02-7ZBoX8xd C.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ir9hw 02-7zbox8xd c.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.905] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iR9hW 02-7ZBoX8xd C.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0251.907] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.907] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.914] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0251.959] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0251.975] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0251.981] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.988] CloseHandle (hObject=0x198) returned 1 [0251.988] CloseHandle (hObject=0x19c) returned 1 [0251.988] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JeIcMKY4D-w.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jeicmky4d-w.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JeIcMKY4D-w.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jeicmky4d-w.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0251.989] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JeIcMKY4D-w.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jeicmky4d-w.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0251.989] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JeIcMKY4D-w.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0251.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0251.991] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0251.998] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.051] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.066] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.070] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.078] CloseHandle (hObject=0x19c) returned 1 [0252.078] CloseHandle (hObject=0x198) returned 1 [0252.078] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQ4xVcloM_4v468Mr7ph.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jq4xvclom_4v468mr7ph.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQ4xVcloM_4v468Mr7ph.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jq4xvclom_4v468mr7ph.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.079] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQ4xVcloM_4v468Mr7ph.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jq4xvclom_4v468mr7ph.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.079] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQ4xVcloM_4v468Mr7ph.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0252.081] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.081] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.089] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.173] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.188] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.192] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.199] CloseHandle (hObject=0x198) returned 1 [0252.199] CloseHandle (hObject=0x19c) returned 1 [0252.199] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQa8.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jqa8.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQa8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jqa8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.200] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQa8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jqa8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.200] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JQa8.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0252.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.202] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.208] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.253] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.280] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.284] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.291] CloseHandle (hObject=0x19c) returned 1 [0252.291] CloseHandle (hObject=0x198) returned 1 [0252.291] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JZqQyIQ8g.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jzqqyiq8g.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JZqQyIQ8g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jzqqyiq8g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.292] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JZqQyIQ8g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\jzqqyiq8g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.292] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JZqQyIQ8g.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0252.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.294] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.300] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.406] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.423] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.427] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.433] CloseHandle (hObject=0x198) returned 1 [0252.433] CloseHandle (hObject=0x19c) returned 1 [0252.434] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k-LUIZvZ6goJH4XtDZ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\k-luizvz6gojh4xtdz.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k-LUIZvZ6goJH4XtDZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\k-luizvz6gojh4xtdz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.434] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k-LUIZvZ6goJH4XtDZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\k-luizvz6gojh4xtdz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.434] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\k-LUIZvZ6goJH4XtDZ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0252.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.436] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.443] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.489] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.504] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.508] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.516] CloseHandle (hObject=0x19c) returned 1 [0252.516] CloseHandle (hObject=0x198) returned 1 [0252.516] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K6w2S Eo1Qyv.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\k6w2s eo1qyv.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K6w2S Eo1Qyv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\k6w2s eo1qyv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.517] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K6w2S Eo1Qyv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\k6w2s eo1qyv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.517] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\K6w2S Eo1Qyv.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0252.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.519] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.526] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.572] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.588] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.591] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.598] CloseHandle (hObject=0x198) returned 1 [0252.598] CloseHandle (hObject=0x19c) returned 1 [0252.598] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgISQU_Uf0C.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kgisqu_uf0c.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgISQU_Uf0C.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kgisqu_uf0c.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.599] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgISQU_Uf0C.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kgisqu_uf0c.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.599] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kgISQU_Uf0C.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0252.601] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.601] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.609] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.653] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.668] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.673] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.679] CloseHandle (hObject=0x19c) returned 1 [0252.680] CloseHandle (hObject=0x198) returned 1 [0252.680] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKml FeU1m.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kkml feu1m.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKml FeU1m.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kkml feu1m.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.681] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKml FeU1m.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kkml feu1m.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.681] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKml FeU1m.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0252.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.683] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.689] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.754] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.761] CloseHandle (hObject=0x198) returned 1 [0252.761] CloseHandle (hObject=0x19c) returned 1 [0252.761] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kp r_cnqraWc1vxAfk2d.ots.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kp r_cnqrawc1vxafk2d.ots.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kp r_cnqraWc1vxAfk2d.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kp r_cnqrawc1vxafk2d.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.762] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kp r_cnqraWc1vxAfk2d.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kp r_cnqrawc1vxafk2d.ots.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.762] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kp r_cnqraWc1vxAfk2d.ots.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0252.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.763] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.770] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.815] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.830] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.833] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.841] CloseHandle (hObject=0x19c) returned 1 [0252.841] CloseHandle (hObject=0x198) returned 1 [0252.842] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KSik.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ksik.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KSik.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ksik.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KSik.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ksik.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.843] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KSik.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0252.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.844] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.851] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0252.902] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0252.917] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0252.921] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.927] CloseHandle (hObject=0x198) returned 1 [0252.927] CloseHandle (hObject=0x19c) returned 1 [0252.928] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KUHRMTx.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kuhrmtx.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KUHRMTx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kuhrmtx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0252.929] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KUHRMTx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\kuhrmtx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0252.929] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KUHRMTx.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0252.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0252.930] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0252.942] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.004] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.020] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.023] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.030] CloseHandle (hObject=0x19c) returned 1 [0253.030] CloseHandle (hObject=0x198) returned 1 [0253.030] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l3_VlDevN6r.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\l3_vldevn6r.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l3_VlDevN6r.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\l3_vldevn6r.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.031] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l3_VlDevN6r.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\l3_vldevn6r.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.031] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l3_VlDevN6r.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0253.033] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.033] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.041] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.106] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.131] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.138] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.145] CloseHandle (hObject=0x198) returned 1 [0253.145] CloseHandle (hObject=0x19c) returned 1 [0253.145] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l425t-mzJQALfAh.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\l425t-mzjqalfah.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l425t-mzJQALfAh.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\l425t-mzjqalfah.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.146] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l425t-mzJQALfAh.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\l425t-mzjqalfah.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.146] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l425t-mzJQALfAh.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0253.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.148] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.156] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.248] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.263] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.267] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.274] CloseHandle (hObject=0x19c) returned 1 [0253.274] CloseHandle (hObject=0x198) returned 1 [0253.274] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lH99WbBCOIZvNP_d.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lh99wbbcoizvnp_d.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lH99WbBCOIZvNP_d.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lh99wbbcoizvnp_d.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.276] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lH99WbBCOIZvNP_d.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lh99wbbcoizvnp_d.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.276] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lH99WbBCOIZvNP_d.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0253.278] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.278] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.285] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.398] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.423] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.426] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.434] CloseHandle (hObject=0x198) returned 1 [0253.434] CloseHandle (hObject=0x19c) returned 1 [0253.434] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LivN6osvrZhrtk.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\livn6osvrzhrtk.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LivN6osvrZhrtk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\livn6osvrzhrtk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.435] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LivN6osvrZhrtk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\livn6osvrzhrtk.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.435] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LivN6osvrZhrtk.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0253.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.436] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.443] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.497] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.513] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.516] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.523] CloseHandle (hObject=0x19c) returned 1 [0253.523] CloseHandle (hObject=0x198) returned 1 [0253.524] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lSgeBdD5QfyUtT.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lsgebdd5qfyutt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lSgeBdD5QfyUtT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lsgebdd5qfyutt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.525] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lSgeBdD5QfyUtT.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lsgebdd5qfyutt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.525] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lSgeBdD5QfyUtT.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0253.526] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.527] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.533] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.578] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.595] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.598] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.606] CloseHandle (hObject=0x198) returned 1 [0253.606] CloseHandle (hObject=0x19c) returned 1 [0253.606] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUCpdloIYPm.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lsucpdloiypm.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUCpdloIYPm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lsucpdloiypm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.607] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUCpdloIYPm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\lsucpdloiypm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.608] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LsUCpdloIYPm.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0253.609] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.609] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.616] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.660] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.675] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.679] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.687] CloseHandle (hObject=0x19c) returned 1 [0253.687] CloseHandle (hObject=0x198) returned 1 [0253.687] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\maDEL.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\madel.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\maDEL.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\madel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.688] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\maDEL.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\madel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.688] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\maDEL.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0253.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.690] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.697] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.740] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.756] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.760] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.767] CloseHandle (hObject=0x198) returned 1 [0253.767] CloseHandle (hObject=0x19c) returned 1 [0253.767] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.768] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.768] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0253.770] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.770] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.779] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.824] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.839] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.843] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.849] CloseHandle (hObject=0x19c) returned 1 [0253.850] CloseHandle (hObject=0x198) returned 1 [0253.850] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Naukd1lgvNopp.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\naukd1lgvnopp.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Naukd1lgvNopp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\naukd1lgvnopp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.851] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Naukd1lgvNopp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\naukd1lgvnopp.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.851] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Naukd1lgvNopp.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0253.852] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.852] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.866] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.912] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0253.927] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0253.930] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.937] CloseHandle (hObject=0x198) returned 1 [0253.938] CloseHandle (hObject=0x19c) returned 1 [0253.938] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNJEli31EnkdHTR_.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\nnjeli31enkdhtr_.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNJEli31EnkdHTR_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\nnjeli31enkdhtr_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0253.939] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNJEli31EnkdHTR_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\nnjeli31enkdhtr_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0253.939] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nNJEli31EnkdHTR_.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0253.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0253.940] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0253.948] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0253.991] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.007] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.011] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.017] CloseHandle (hObject=0x19c) returned 1 [0254.018] CloseHandle (hObject=0x198) returned 1 [0254.018] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NoePWOfReY4dkGr.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\noepwofrey4dkgr.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NoePWOfReY4dkGr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\noepwofrey4dkgr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.019] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NoePWOfReY4dkGr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\noepwofrey4dkgr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.019] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NoePWOfReY4dkGr.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0254.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.020] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.029] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.071] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.088] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.092] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.098] CloseHandle (hObject=0x198) returned 1 [0254.098] CloseHandle (hObject=0x19c) returned 1 [0254.099] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nom9EJCWx6Rdthc.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\nom9ejcwx6rdthc.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nom9EJCWx6Rdthc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\nom9ejcwx6rdthc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.099] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nom9EJCWx6Rdthc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\nom9ejcwx6rdthc.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.100] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nom9EJCWx6Rdthc.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0254.101] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.101] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.109] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.153] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.204] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.215] CloseHandle (hObject=0x19c) returned 1 [0254.215] CloseHandle (hObject=0x198) returned 1 [0254.215] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\npiY9sSW2ppmY.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\npiy9ssw2ppmy.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\npiY9sSW2ppmY.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\npiy9ssw2ppmy.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.216] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\npiY9sSW2ppmY.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\npiy9ssw2ppmy.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.216] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\npiY9sSW2ppmY.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0254.217] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.218] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.224] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.269] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.285] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.289] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.296] CloseHandle (hObject=0x198) returned 1 [0254.296] CloseHandle (hObject=0x19c) returned 1 [0254.296] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2Jd9UCaOutyl4b.flv.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\o2jd9ucaoutyl4b.flv.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2Jd9UCaOutyl4b.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\o2jd9ucaoutyl4b.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.297] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2Jd9UCaOutyl4b.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\o2jd9ucaoutyl4b.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.297] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O2Jd9UCaOutyl4b.flv.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0254.298] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.299] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.305] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.474] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.490] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.494] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.501] CloseHandle (hObject=0x19c) returned 1 [0254.501] CloseHandle (hObject=0x198) returned 1 [0254.501] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\odVuOP.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\odvuop.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\odVuOP.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\odvuop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.502] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\odVuOP.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\odvuop.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.502] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\odVuOP.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0254.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.504] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.522] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.595] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.612] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.617] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.624] CloseHandle (hObject=0x198) returned 1 [0254.624] CloseHandle (hObject=0x19c) returned 1 [0254.624] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohiCLuO6R17o874P7-O6.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ohicluo6r17o874p7-o6.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohiCLuO6R17o874P7-O6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ohicluo6r17o874p7-o6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.625] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohiCLuO6R17o874P7-O6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ohicluo6r17o874p7-o6.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohiCLuO6R17o874P7-O6.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0254.627] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.627] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.634] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.745] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.750] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.758] CloseHandle (hObject=0x19c) returned 1 [0254.758] CloseHandle (hObject=0x198) returned 1 [0254.759] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\olku99aBaO5W-e91x9J.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\olku99abao5w-e91x9j.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\olku99aBaO5W-e91x9J.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\olku99abao5w-e91x9j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.760] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\olku99aBaO5W-e91x9J.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\olku99abao5w-e91x9j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.760] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\olku99aBaO5W-e91x9J.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0254.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.761] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.769] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.840] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.869] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.872] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.879] CloseHandle (hObject=0x198) returned 1 [0254.879] CloseHandle (hObject=0x19c) returned 1 [0254.880] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl (2).lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\omrdl (2).lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\omrdl (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.880] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\omrdl (2).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.881] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl (2).lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0254.883] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.883] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.890] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0254.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0254.955] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0254.958] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.965] CloseHandle (hObject=0x19c) returned 1 [0254.965] CloseHandle (hObject=0x198) returned 1 [0254.965] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\omrdl.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\omrdl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0254.966] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\omrdl.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0254.967] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OmRdl.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0254.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0254.968] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0254.977] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.030] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.048] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.052] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.059] CloseHandle (hObject=0x198) returned 1 [0255.059] CloseHandle (hObject=0x19c) returned 1 [0255.059] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oRltFs8.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\orltfs8.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oRltFs8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\orltfs8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.060] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oRltFs8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\orltfs8.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.060] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oRltFs8.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535080 [0255.061] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.062] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.068] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.116] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.136] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.140] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.147] CloseHandle (hObject=0x19c) returned 1 [0255.147] CloseHandle (hObject=0x198) returned 1 [0255.147] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p2HD0LVeTQwB2.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\p2hd0lvetqwb2.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p2HD0LVeTQwB2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\p2hd0lvetqwb2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.148] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p2HD0LVeTQwB2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\p2hd0lvetqwb2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.148] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p2HD0LVeTQwB2.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0255.150] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.150] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.157] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.218] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.222] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.232] CloseHandle (hObject=0x198) returned 1 [0255.232] CloseHandle (hObject=0x19c) returned 1 [0255.233] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pigyy4X5kC4rU75Hdku.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\pigyy4x5kc4ru75hdku.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pigyy4X5kC4rU75Hdku.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\pigyy4x5kc4ru75hdku.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.234] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pigyy4X5kC4rU75Hdku.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\pigyy4x5kc4ru75hdku.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.234] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pigyy4X5kC4rU75Hdku.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0255.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.238] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.245] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.290] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.405] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.408] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.416] CloseHandle (hObject=0x19c) returned 1 [0255.417] CloseHandle (hObject=0x198) returned 1 [0255.417] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P_LC95GkyruRl_.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\p_lc95gkyrurl_.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P_LC95GkyruRl_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\p_lc95gkyrurl_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.418] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P_LC95GkyruRl_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\p_lc95gkyrurl_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.418] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\P_LC95GkyruRl_.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0255.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.420] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.427] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.472] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.487] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.491] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.498] CloseHandle (hObject=0x198) returned 1 [0255.498] CloseHandle (hObject=0x19c) returned 1 [0255.498] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qA5Zqo1h6yh3gM.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\qa5zqo1h6yh3gm.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qA5Zqo1h6yh3gM.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\qa5zqo1h6yh3gm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.499] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qA5Zqo1h6yh3gM.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\qa5zqo1h6yh3gm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.499] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qA5Zqo1h6yh3gM.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0255.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.501] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.514] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.566] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.583] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.589] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.595] CloseHandle (hObject=0x19c) returned 1 [0255.595] CloseHandle (hObject=0x198) returned 1 [0255.596] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QBnyg_J5NSSAHEj24.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\qbnyg_j5nssahej24.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QBnyg_J5NSSAHEj24.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\qbnyg_j5nssahej24.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.597] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QBnyg_J5NSSAHEj24.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\qbnyg_j5nssahej24.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.597] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QBnyg_J5NSSAHEj24.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0255.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.598] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.608] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.653] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.668] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.671] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.679] CloseHandle (hObject=0x198) returned 1 [0255.679] CloseHandle (hObject=0x19c) returned 1 [0255.679] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R1sFby.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\r1sfby.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R1sFby.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\r1sfby.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.680] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R1sFby.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\r1sfby.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.680] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R1sFby.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0255.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.681] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.688] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.733] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.750] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.753] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.760] CloseHandle (hObject=0x19c) returned 1 [0255.760] CloseHandle (hObject=0x198) returned 1 [0255.760] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RgqslTJq2Au1TsA_Je.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rgqsltjq2au1tsa_je.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RgqslTJq2Au1TsA_Je.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rgqsltjq2au1tsa_je.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.761] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RgqslTJq2Au1TsA_Je.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rgqsltjq2au1tsa_je.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.761] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RgqslTJq2Au1TsA_Je.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0255.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.763] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.770] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.816] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.831] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.836] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.843] CloseHandle (hObject=0x198) returned 1 [0255.843] CloseHandle (hObject=0x19c) returned 1 [0255.843] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIpG-q.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ripg-q.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIpG-q.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ripg-q.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.844] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIpG-q.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ripg-q.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.844] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rIpG-q.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0255.845] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.846] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.858] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0255.905] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0255.920] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0255.924] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.947] CloseHandle (hObject=0x19c) returned 1 [0255.947] CloseHandle (hObject=0x198) returned 1 [0255.947] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0255.948] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0255.948] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0255.950] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0255.951] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0255.959] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.003] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.021] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.026] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.035] CloseHandle (hObject=0x198) returned 1 [0256.035] CloseHandle (hObject=0x19c) returned 1 [0256.036] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RSND0b.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rsnd0b.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RSND0b.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rsnd0b.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.037] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RSND0b.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rsnd0b.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.037] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RSND0b.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0256.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.042] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.051] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.094] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.112] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.117] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.126] CloseHandle (hObject=0x19c) returned 1 [0256.126] CloseHandle (hObject=0x198) returned 1 [0256.126] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rYbUAJVeV1lhh3ffAs.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rybuajvev1lhh3ffas.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rYbUAJVeV1lhh3ffAs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rybuajvev1lhh3ffas.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.127] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rYbUAJVeV1lhh3ffAs.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\rybuajvev1lhh3ffas.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.127] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rYbUAJVeV1lhh3ffAs.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0256.129] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.129] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.138] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.202] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.220] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.224] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.231] CloseHandle (hObject=0x198) returned 1 [0256.231] CloseHandle (hObject=0x19c) returned 1 [0256.232] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ScAxfF84s695W5.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\scaxff84s695w5.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ScAxfF84s695W5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\scaxff84s695w5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.233] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ScAxfF84s695W5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\scaxff84s695w5.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.233] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ScAxfF84s695W5.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0256.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.234] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.242] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.299] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.382] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.386] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.393] CloseHandle (hObject=0x19c) returned 1 [0256.393] CloseHandle (hObject=0x198) returned 1 [0256.393] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SdjIvgxycEt09p1E9a8G.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\sdjivgxycet09p1e9a8g.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SdjIvgxycEt09p1E9a8G.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\sdjivgxycet09p1e9a8g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.394] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SdjIvgxycEt09p1E9a8G.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\sdjivgxycet09p1e9a8g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.394] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SdjIvgxycEt09p1E9a8G.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0256.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.396] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.403] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.448] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.464] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.468] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.474] CloseHandle (hObject=0x198) returned 1 [0256.475] CloseHandle (hObject=0x19c) returned 1 [0256.475] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tc7c1YUidUyGRX137CFt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tc7c1yuiduygrx137cft.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tc7c1YUidUyGRX137CFt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tc7c1yuiduygrx137cft.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.477] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tc7c1YUidUyGRX137CFt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tc7c1yuiduygrx137cft.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.477] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Tc7c1YUidUyGRX137CFt.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0256.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.479] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.486] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.531] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.552] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.556] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.563] CloseHandle (hObject=0x19c) returned 1 [0256.563] CloseHandle (hObject=0x198) returned 1 [0256.563] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tCsxBjd.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tcsxbjd.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tCsxBjd.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tcsxbjd.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.564] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tCsxBjd.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tcsxbjd.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.564] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tCsxBjd.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0256.566] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.566] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.580] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.628] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.645] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.649] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.656] CloseHandle (hObject=0x198) returned 1 [0256.656] CloseHandle (hObject=0x19c) returned 1 [0256.656] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\texqmfr_5PapALcsh1.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\texqmfr_5papalcsh1.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\texqmfr_5PapALcsh1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\texqmfr_5papalcsh1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.657] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\texqmfr_5PapALcsh1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\texqmfr_5papalcsh1.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.657] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\texqmfr_5PapALcsh1.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0256.658] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.659] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.667] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.718] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.733] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.737] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.745] CloseHandle (hObject=0x19c) returned 1 [0256.745] CloseHandle (hObject=0x198) returned 1 [0256.745] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TiEKn-h a1TPcZWHUc7_.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tiekn-h a1tpczwhuc7_.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TiEKn-h a1TPcZWHUc7_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tiekn-h a1tpczwhuc7_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.746] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TiEKn-h a1TPcZWHUc7_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tiekn-h a1tpczwhuc7_.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.746] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TiEKn-h a1TPcZWHUc7_.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5353c0 [0256.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.748] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.754] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.802] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.819] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.823] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.830] CloseHandle (hObject=0x198) returned 1 [0256.830] CloseHandle (hObject=0x19c) returned 1 [0256.830] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TUbsjE33j.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tubsje33j.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TUbsjE33j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tubsje33j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.831] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TUbsjE33j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tubsje33j.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.831] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TUbsjE33j.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0256.832] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.833] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.840] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.891] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.906] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.911] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.918] CloseHandle (hObject=0x19c) returned 1 [0256.918] CloseHandle (hObject=0x198) returned 1 [0256.918] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TZzlZ8dfma.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tzzlz8dfma.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TZzlZ8dfma.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tzzlz8dfma.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0256.919] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TZzlZ8dfma.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\tzzlz8dfma.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0256.919] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TZzlZ8dfma.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0256.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0256.921] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0256.928] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0256.973] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0256.989] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0256.993] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.000] CloseHandle (hObject=0x198) returned 1 [0257.000] CloseHandle (hObject=0x19c) returned 1 [0257.000] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u84U04YtpKdm7.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\u84u04ytpkdm7.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u84U04YtpKdm7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\u84u04ytpkdm7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.001] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u84U04YtpKdm7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\u84u04ytpkdm7.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.001] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\u84U04YtpKdm7.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0257.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.003] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.010] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.063] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.079] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.083] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.090] CloseHandle (hObject=0x19c) returned 1 [0257.090] CloseHandle (hObject=0x198) returned 1 [0257.090] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBu62lVbrR.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ubu62lvbrr.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBu62lVbrR.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ubu62lvbrr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.091] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBu62lVbrR.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ubu62lvbrr.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBu62lVbrR.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0257.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.093] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.100] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.180] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.197] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.201] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.207] CloseHandle (hObject=0x198) returned 1 [0257.207] CloseHandle (hObject=0x19c) returned 1 [0257.208] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uehKAxye-.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uehkaxye-.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uehKAxye-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uehkaxye-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.208] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uehKAxye-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uehkaxye-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.209] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uehKAxye-.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0257.211] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.211] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.218] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.266] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.282] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.286] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.295] CloseHandle (hObject=0x19c) returned 1 [0257.295] CloseHandle (hObject=0x198) returned 1 [0257.296] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uh-fzi.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uh-fzi.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uh-fzi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uh-fzi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.297] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uh-fzi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uh-fzi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.297] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uh-fzi.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0257.299] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.299] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.361] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.406] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.422] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.425] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.432] CloseHandle (hObject=0x198) returned 1 [0257.432] CloseHandle (hObject=0x19c) returned 1 [0257.432] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uRDQ0HtrTVs-S 2.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\urdq0htrtvs-s 2.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uRDQ0HtrTVs-S 2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\urdq0htrtvs-s 2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.433] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uRDQ0HtrTVs-S 2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\urdq0htrtvs-s 2.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.433] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\uRDQ0HtrTVs-S 2.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535000 [0257.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.435] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.442] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.500] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.520] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.524] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.531] CloseHandle (hObject=0x19c) returned 1 [0257.531] CloseHandle (hObject=0x198) returned 1 [0257.531] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UVRh6IiNtS_khx0T S.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uvrh6iints_khx0t s.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UVRh6IiNtS_khx0T S.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uvrh6iints_khx0t s.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.532] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UVRh6IiNtS_khx0T S.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uvrh6iints_khx0t s.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.532] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UVRh6IiNtS_khx0T S.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0257.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.534] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.545] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.602] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.620] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.623] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.630] CloseHandle (hObject=0x198) returned 1 [0257.630] CloseHandle (hObject=0x19c) returned 1 [0257.630] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UWj9ut.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uwj9ut.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UWj9ut.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uwj9ut.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.632] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UWj9ut.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\uwj9ut.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.632] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UWj9ut.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0257.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.634] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.641] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.688] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.705] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.710] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.719] CloseHandle (hObject=0x19c) returned 1 [0257.720] CloseHandle (hObject=0x198) returned 1 [0257.720] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ve4qO3bmFfQj.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ve4qo3bmffqj.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ve4qO3bmFfQj.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ve4qo3bmffqj.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.721] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ve4qO3bmFfQj.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ve4qo3bmffqj.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.721] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ve4qO3bmFfQj.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0257.723] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.724] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.750] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.807] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.827] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.831] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.841] CloseHandle (hObject=0x198) returned 1 [0257.841] CloseHandle (hObject=0x19c) returned 1 [0257.841] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VmthFi4ad.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vmthfi4ad.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VmthFi4ad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vmthfi4ad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.842] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VmthFi4ad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vmthfi4ad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.842] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VmthFi4ad.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0257.844] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.844] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.851] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.902] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0257.918] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0257.922] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.929] CloseHandle (hObject=0x19c) returned 1 [0257.930] CloseHandle (hObject=0x198) returned 1 [0257.930] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VP zyzkWkddL0Ek36Jx.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vp zyzkwkddl0ek36jx.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VP zyzkWkddL0Ek36Jx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vp zyzkwkddl0ek36jx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0257.931] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VP zyzkWkddL0Ek36Jx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vp zyzkwkddl0ek36jx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0257.931] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VP zyzkWkddL0Ek36Jx.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0257.932] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0257.932] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0257.939] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0257.984] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.000] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.003] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.010] CloseHandle (hObject=0x198) returned 1 [0258.011] CloseHandle (hObject=0x19c) returned 1 [0258.011] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vrk83rwqfhzxiC5tl N.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vrk83rwqfhzxic5tl n.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vrk83rwqfhzxiC5tl N.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vrk83rwqfhzxic5tl n.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.012] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vrk83rwqfhzxiC5tl N.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vrk83rwqfhzxic5tl n.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.012] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vrk83rwqfhzxiC5tl N.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0258.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.013] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.020] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.065] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.082] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.086] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.092] CloseHandle (hObject=0x19c) returned 1 [0258.092] CloseHandle (hObject=0x198) returned 1 [0258.093] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VW0yqU0iFkC2G.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vw0yqu0ifkc2g.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VW0yqU0iFkC2G.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vw0yqu0ifkc2g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.094] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VW0yqU0iFkC2G.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vw0yqu0ifkc2g.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.094] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VW0yqU0iFkC2G.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0258.095] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.095] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.104] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.149] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.164] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.168] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.174] CloseHandle (hObject=0x198) returned 1 [0258.175] CloseHandle (hObject=0x19c) returned 1 [0258.175] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VYbYDnyR-.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vybydnyr-.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VYbYDnyR-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vybydnyr-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.176] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VYbYDnyR-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vybydnyr-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.176] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VYbYDnyR-.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0258.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.177] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.186] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.233] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.249] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.253] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.260] CloseHandle (hObject=0x19c) returned 1 [0258.260] CloseHandle (hObject=0x198) returned 1 [0258.261] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vzQxhnLmv1wl5nFt-.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vzqxhnlmv1wl5nft-.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vzQxhnLmv1wl5nFt-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vzqxhnlmv1wl5nft-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.262] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vzQxhnLmv1wl5nFt-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\vzqxhnlmv1wl5nft-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.262] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vzQxhnLmv1wl5nFt-.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0258.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.264] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.271] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.418] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.434] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.438] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.444] CloseHandle (hObject=0x198) returned 1 [0258.444] CloseHandle (hObject=0x19c) returned 1 [0258.445] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W2fC0ynrNVZ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\w2fc0ynrnvz.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W2fC0ynrNVZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\w2fc0ynrnvz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.446] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W2fC0ynrNVZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\w2fc0ynrnvz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.446] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W2fC0ynrNVZ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0258.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.448] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.455] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.499] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.516] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.520] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.527] CloseHandle (hObject=0x19c) returned 1 [0258.527] CloseHandle (hObject=0x198) returned 1 [0258.527] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w4TzgFPPw9Ins-5su.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\w4tzgfppw9ins-5su.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w4TzgFPPw9Ins-5su.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\w4tzgfppw9ins-5su.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.528] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w4TzgFPPw9Ins-5su.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\w4tzgfppw9ins-5su.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.528] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w4TzgFPPw9Ins-5su.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0258.529] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.530] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.537] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.582] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.597] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.617] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.623] CloseHandle (hObject=0x198) returned 1 [0258.624] CloseHandle (hObject=0x19c) returned 1 [0258.624] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wAFeHTDXuD9zbyzpjX0f.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wafehtdxud9zbyzpjx0f.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wAFeHTDXuD9zbyzpjX0f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wafehtdxud9zbyzpjx0f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.625] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wAFeHTDXuD9zbyzpjX0f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wafehtdxud9zbyzpjx0f.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.625] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wAFeHTDXuD9zbyzpjX0f.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0258.626] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.626] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.634] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.694] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.711] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.718] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.724] CloseHandle (hObject=0x19c) returned 1 [0258.724] CloseHandle (hObject=0x198) returned 1 [0258.725] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WbU_4EkqZ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wbu_4ekqz.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WbU_4EkqZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wbu_4ekqz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.726] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WbU_4EkqZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wbu_4ekqz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.726] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WbU_4EkqZ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0258.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.730] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.737] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.781] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.797] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.801] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.808] CloseHandle (hObject=0x198) returned 1 [0258.808] CloseHandle (hObject=0x19c) returned 1 [0258.808] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wdQ6d-5CMGpIZ4M5H.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wdq6d-5cmgpiz4m5h.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wdQ6d-5CMGpIZ4M5H.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wdq6d-5cmgpiz4m5h.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.809] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wdQ6d-5CMGpIZ4M5H.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wdq6d-5cmgpiz4m5h.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.809] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wdQ6d-5CMGpIZ4M5H.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534c80 [0258.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.811] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.818] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.863] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.885] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.889] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.896] CloseHandle (hObject=0x19c) returned 1 [0258.896] CloseHandle (hObject=0x198) returned 1 [0258.896] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wTJf9yHg1v 7wUqhRIS.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wtjf9yhg1v 7wuqhris.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wTJf9yHg1v 7wUqhRIS.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wtjf9yhg1v 7wuqhris.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.898] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wTJf9yHg1v 7wUqhRIS.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wtjf9yhg1v 7wuqhris.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.898] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wTJf9yHg1v 7wUqhRIS.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0258.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.900] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.907] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0258.954] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0258.970] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0258.974] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.981] CloseHandle (hObject=0x198) returned 1 [0258.981] CloseHandle (hObject=0x19c) returned 1 [0258.981] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wxOZqRdh.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wxozqrdh.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wxOZqRdh.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wxozqrdh.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0258.982] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wxOZqRdh.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\wxozqrdh.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0258.983] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wxOZqRdh.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0258.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0258.984] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0258.993] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.051] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.075] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.079] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.090] CloseHandle (hObject=0x19c) returned 1 [0259.090] CloseHandle (hObject=0x198) returned 1 [0259.091] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x8Ms.flv.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\x8ms.flv.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x8Ms.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\x8ms.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.092] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x8Ms.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\x8ms.flv.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.092] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\x8Ms.flv.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f40 [0259.093] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.093] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.101] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.167] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.184] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.188] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.194] CloseHandle (hObject=0x198) returned 1 [0259.194] CloseHandle (hObject=0x19c) returned 1 [0259.195] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xglIx.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\xglix.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xglIx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\xglix.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.196] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xglIx.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\xglix.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.196] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xglIx.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0259.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.198] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.206] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.252] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.269] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.273] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.280] CloseHandle (hObject=0x19c) returned 1 [0259.280] CloseHandle (hObject=0x198) returned 1 [0259.280] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xkvVvMweHLBA321hXpG.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\xkvvvmwehlba321hxpg.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xkvVvMweHLBA321hXpG.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\xkvvvmwehlba321hxpg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.281] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xkvVvMweHLBA321hXpG.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\xkvvvmwehlba321hxpg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.281] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xkvVvMweHLBA321hXpG.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534f00 [0259.282] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.283] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.290] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.405] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.420] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.424] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.433] CloseHandle (hObject=0x198) returned 1 [0259.433] CloseHandle (hObject=0x19c) returned 1 [0259.434] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4EnWoJgWqAZ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\y4enwojgwqaz.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4EnWoJgWqAZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\y4enwojgwqaz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.435] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4EnWoJgWqAZ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\y4enwojgwqaz.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.435] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y4EnWoJgWqAZ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0259.436] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.436] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.443] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.489] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.506] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.510] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.517] CloseHandle (hObject=0x19c) returned 1 [0259.517] CloseHandle (hObject=0x198) returned 1 [0259.517] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEd_bIJQ8xxnzm.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yed_bijq8xxnzm.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEd_bIJQ8xxnzm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yed_bijq8xxnzm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.518] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEd_bIJQ8xxnzm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yed_bijq8xxnzm.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.518] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yEd_bIJQ8xxnzm.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0259.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.520] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.526] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.571] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.590] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.594] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.603] CloseHandle (hObject=0x198) returned 1 [0259.603] CloseHandle (hObject=0x19c) returned 1 [0259.603] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yiCQChyZCjCbU0.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yicqchyzcjcbu0.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yiCQChyZCjCbU0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yicqchyzcjcbu0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.605] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yiCQChyZCjCbU0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yicqchyzcjcbu0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.605] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yiCQChyZCjCbU0.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0259.607] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.607] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.616] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.663] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.679] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.682] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.689] CloseHandle (hObject=0x19c) returned 1 [0259.689] CloseHandle (hObject=0x198) returned 1 [0259.689] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yIzlP6Gl3T7I-n0.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yizlp6gl3t7i-n0.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yIzlP6Gl3T7I-n0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yizlp6gl3t7i-n0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.690] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yIzlP6Gl3T7I-n0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\yizlp6gl3t7i-n0.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.691] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yIzlP6Gl3T7I-n0.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535200 [0259.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.693] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.699] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.743] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.760] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.763] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.770] CloseHandle (hObject=0x198) returned 1 [0259.770] CloseHandle (hObject=0x19c) returned 1 [0259.770] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YLQ00Xlw-k9.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ylq00xlw-k9.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YLQ00Xlw-k9.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ylq00xlw-k9.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.771] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YLQ00Xlw-k9.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ylq00xlw-k9.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.771] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YLQ00Xlw-k9.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535040 [0259.773] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.773] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.780] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.824] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.839] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.843] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.850] CloseHandle (hObject=0x19c) returned 1 [0259.850] CloseHandle (hObject=0x198) returned 1 [0259.850] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YsjIvbu1oXPyRyrQ.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ysjivbu1oxpyryrq.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YsjIvbu1oXPyRyrQ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ysjivbu1oxpyryrq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.851] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YsjIvbu1oXPyRyrQ.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\ysjivbu1oxpyryrq.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.851] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YsjIvbu1oXPyRyrQ.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0259.853] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.853] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.860] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.914] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0259.931] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0259.935] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.942] CloseHandle (hObject=0x198) returned 1 [0259.943] CloseHandle (hObject=0x19c) returned 1 [0259.943] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbeILBBaI9zUs9TeGo0S.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\zbeilbbai9zus9tego0s.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbeILBBaI9zUs9TeGo0S.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\zbeilbbai9zus9tego0s.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0259.944] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbeILBBaI9zUs9TeGo0S.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\zbeilbbai9zus9tego0s.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0259.944] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zbeILBBaI9zUs9TeGo0S.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535380 [0259.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0259.946] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0259.952] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0259.996] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.011] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.015] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.022] CloseHandle (hObject=0x19c) returned 1 [0260.022] CloseHandle (hObject=0x198) returned 1 [0260.022] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZPia.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\zpia.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZPia.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\zpia.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.023] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZPia.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\zpia.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.023] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZPia.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0260.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.025] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.032] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.091] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.106] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.110] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.117] CloseHandle (hObject=0x198) returned 1 [0260.117] CloseHandle (hObject=0x19c) returned 1 [0260.117] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DK9nVuOrR0f_XzYg.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_dk9nvuorr0f_xzyg.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DK9nVuOrR0f_XzYg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_dk9nvuorr0f_xzyg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.118] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DK9nVuOrR0f_XzYg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_dk9nvuorr0f_xzyg.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.118] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_DK9nVuOrR0f_XzYg.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535300 [0260.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.120] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.127] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.208] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.225] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.229] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.236] CloseHandle (hObject=0x19c) returned 1 [0260.236] CloseHandle (hObject=0x198) returned 1 [0260.236] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Ict8XAZlaDW1P1aC-.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_ict8xazladw1p1ac-.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Ict8XAZlaDW1P1aC-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_ict8xazladw1p1ac-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.238] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Ict8XAZlaDW1P1aC-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_ict8xazladw1p1ac-.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.238] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_Ict8XAZlaDW1P1aC-.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534ec0 [0260.240] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.241] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.248] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.295] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.362] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.366] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.373] CloseHandle (hObject=0x198) returned 1 [0260.373] CloseHandle (hObject=0x19c) returned 1 [0260.373] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_LJ_AnzNVBBb0_IwtHPb.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_lj_anznvbbb0_iwthpb.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_LJ_AnzNVBBb0_IwtHPb.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_lj_anznvbbb0_iwthpb.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.374] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_LJ_AnzNVBBb0_IwtHPb.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_lj_anznvbbb0_iwthpb.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.374] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_LJ_AnzNVBBb0_IwtHPb.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0260.376] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.376] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.386] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.430] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.446] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.450] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.457] CloseHandle (hObject=0x19c) returned 1 [0260.457] CloseHandle (hObject=0x198) returned 1 [0260.457] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_uheS1ZI.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_uhes1zi.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_uheS1ZI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_uhes1zi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.458] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_uheS1ZI.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\recent\\_uhes1zi.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.458] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_uheS1ZI.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x534e40 [0260.472] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.473] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.479] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.526] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.542] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.545] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.552] CloseHandle (hObject=0x198) returned 1 [0260.552] CloseHandle (hObject=0x19c) returned 1 [0260.553] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.554] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.554] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0260.555] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.556] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.563] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.608] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.627] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.633] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.645] CloseHandle (hObject=0x19c) returned 1 [0260.645] CloseHandle (hObject=0x198) returned 1 [0260.645] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.648] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.648] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x5351c0 [0260.651] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.651] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.659] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.704] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.720] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.724] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.730] CloseHandle (hObject=0x198) returned 1 [0260.731] CloseHandle (hObject=0x19c) returned 1 [0260.732] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.733] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.733] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x19eba8 | out: lpFindFileData=0x19eba8) returned 0x535180 [0260.737] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.737] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.744] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.789] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.808] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.811] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.818] CloseHandle (hObject=0x1a4) returned 1 [0260.818] CloseHandle (hObject=0x1a0) returned 1 [0260.819] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.823] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.823] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535180 [0260.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.828] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.835] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0260.889] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0260.905] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0260.908] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.915] CloseHandle (hObject=0x1a0) returned 1 [0260.915] CloseHandle (hObject=0x1a4) returned 1 [0260.917] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0260.920] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0260.920] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535200 [0260.926] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0260.926] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0260.933] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.026] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.041] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.045] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.051] CloseHandle (hObject=0x1a4) returned 1 [0261.051] CloseHandle (hObject=0x1a0) returned 1 [0261.054] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.056] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.056] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535180 [0261.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.063] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.070] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.115] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.130] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.134] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.141] CloseHandle (hObject=0x1a0) returned 1 [0261.141] CloseHandle (hObject=0x1a4) returned 1 [0261.141] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.142] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.142] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535240 [0261.147] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.147] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.155] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.199] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.214] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.218] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.225] CloseHandle (hObject=0x1a4) returned 1 [0261.225] CloseHandle (hObject=0x1a0) returned 1 [0261.226] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.230] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.230] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535300 [0261.237] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.237] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.246] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.407] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.423] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.427] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.434] CloseHandle (hObject=0x1a0) returned 1 [0261.434] CloseHandle (hObject=0x1a4) returned 1 [0261.442] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.445] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.445] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535300 [0261.453] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.453] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.460] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.508] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.524] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.528] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.535] CloseHandle (hObject=0x1a4) returned 1 [0261.535] CloseHandle (hObject=0x1a0) returned 1 [0261.536] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.537] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.537] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e40 [0261.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.538] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.547] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.593] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.609] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.613] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.620] CloseHandle (hObject=0x1a0) returned 1 [0261.620] CloseHandle (hObject=0x1a4) returned 1 [0261.621] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.623] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.623] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535040 [0261.629] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.629] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.636] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.833] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0261.850] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0261.860] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.866] CloseHandle (hObject=0x198) returned 1 [0261.866] CloseHandle (hObject=0x1a4) returned 1 [0261.867] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0261.868] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0261.868] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534c80 [0261.870] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0261.870] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0261.877] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0261.984] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.011] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.014] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.021] CloseHandle (hObject=0x198) returned 1 [0262.021] CloseHandle (hObject=0x1a0) returned 1 [0262.021] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.022] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.022] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535240 [0262.025] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.026] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.033] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.090] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.107] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.111] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.118] CloseHandle (hObject=0x1a4) returned 1 [0262.118] CloseHandle (hObject=0x1a0) returned 1 [0262.118] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.119] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.119] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", lpFindFileData=0x19e940 | out: lpFindFileData=0x19e940) returned 0x534e40 [0262.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.121] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.127] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.193] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.208] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.213] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.220] CloseHandle (hObject=0x1a4) returned 1 [0262.220] CloseHandle (hObject=0x198) returned 1 [0262.220] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.221] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.221] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0262.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.234] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.240] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.414] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.431] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.435] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.442] CloseHandle (hObject=0x198) returned 1 [0262.442] CloseHandle (hObject=0x1a4) returned 1 [0262.442] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\send to onenote.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\send to onenote.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.443] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\send to onenote.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.444] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Send to OneNote.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e40 [0262.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.450] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.457] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.518] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.535] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.538] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.545] CloseHandle (hObject=0x1a4) returned 1 [0262.545] CloseHandle (hObject=0x198) returned 1 [0262.546] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.547] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.547] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0262.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.549] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.575] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.633] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.650] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.654] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.661] CloseHandle (hObject=0x198) returned 1 [0262.661] CloseHandle (hObject=0x1a4) returned 1 [0262.661] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.662] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.662] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534f00 [0262.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.664] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.684] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.756] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.774] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.778] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.785] CloseHandle (hObject=0x1a4) returned 1 [0262.785] CloseHandle (hObject=0x198) returned 1 [0262.785] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.786] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.786] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535040 [0262.788] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.788] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.808] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.865] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.880] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.894] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.903] CloseHandle (hObject=0x198) returned 1 [0262.903] CloseHandle (hObject=0x1a4) returned 1 [0262.903] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0262.904] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\default apps.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0262.904] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Default Apps.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e40 [0262.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0262.906] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0262.913] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0262.971] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0262.989] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0262.993] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.000] CloseHandle (hObject=0x1a4) returned 1 [0263.000] CloseHandle (hObject=0x198) returned 1 [0263.000] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.001] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.001] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534f40 [0263.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.003] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.010] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.071] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.099] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.103] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.110] CloseHandle (hObject=0x198) returned 1 [0263.110] CloseHandle (hObject=0x1a4) returned 1 [0263.110] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.111] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\devices.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.111] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Devices.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5351c0 [0263.113] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.113] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.122] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.186] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.215] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.219] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.226] CloseHandle (hObject=0x1a4) returned 1 [0263.226] CloseHandle (hObject=0x198) returned 1 [0263.226] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.228] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.229] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534c80 [0263.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.230] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.238] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.390] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.405] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.409] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.418] CloseHandle (hObject=0x198) returned 1 [0263.418] CloseHandle (hObject=0x1a4) returned 1 [0263.418] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.419] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.419] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535040 [0263.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.421] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.427] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.483] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.498] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.502] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.520] CloseHandle (hObject=0x1a4) returned 1 [0263.521] CloseHandle (hObject=0x198) returned 1 [0263.521] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.522] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.522] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5351c0 [0263.523] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.525] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.532] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.589] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.613] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.616] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.625] CloseHandle (hObject=0x198) returned 1 [0263.625] CloseHandle (hObject=0x1a4) returned 1 [0263.625] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.626] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\desktop.ini.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.626] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\desktop.ini", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x5353c0 [0263.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.628] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.635] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.693] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.724] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.728] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.735] CloseHandle (hObject=0x1a4) returned 1 [0263.735] CloseHandle (hObject=0x198) returned 1 [0263.738] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.742] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.742] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0263.756] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.756] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.764] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.813] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.829] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.833] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.840] CloseHandle (hObject=0x198) returned 1 [0263.840] CloseHandle (hObject=0x1a4) returned 1 [0263.842] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.845] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.845] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534cc0 [0263.855] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.855] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.862] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0263.920] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0263.937] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0263.940] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.948] CloseHandle (hObject=0x1a4) returned 1 [0263.948] CloseHandle (hObject=0x198) returned 1 [0263.950] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0263.954] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0263.954] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x535040 [0263.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e40000 [0263.971] VirtualAlloc (lpAddress=0x1e40000, dwSize=0x40c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e40000 [0263.982] VirtualAlloc (lpAddress=0x1d48000, dwSize=0xf8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d48000 [0264.047] VirtualFree (lpAddress=0x1e40000, dwSize=0x40c000, dwFreeType=0x4000) returned 1 [0264.064] VirtualFree (lpAddress=0x1d48000, dwSize=0xf8000, dwFreeType=0x4000) returned 1 [0264.068] VirtualFree (lpAddress=0x1e40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.075] CloseHandle (hObject=0x198) returned 1 [0264.075] CloseHandle (hObject=0x1a4) returned 1 [0264.078] MoveFileA (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0 [0264.081] GetFileAttributesA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.crypted_pony_test_build_xxx_xxx_xxx_xxx_xxx")) returned 0x20 [0264.081] FindFirstFileA (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", lpFindFileData=0x19e6d8 | out: lpFindFileData=0x19e6d8) returned 0x534e40 Thread: id = 2 os_tid = 0xe60